hub: HostCapabilityChecker — operator alert on agent capability-degraded (v0.19.0)

Companion to felhom-agent v0.44.0. New monitor.HostCapabilityChecker (sibling of
HostStalenessChecker) reads the capabilities snapshot from the latest host report and emits
agent_capability_degraded/recovered (operator-only, 1h cooldown) on ok<->degraded transitions
for any Critical capability. store.GetHostCapabilities (MAX(id), no migration). Goldens mirror
the new capabilities field.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

hub/cmd/hub/main.go

@@ -316,6 +316,9 @@ func main() {
 	// v0.7.0: host-domain dead-man's-switch (sibling; the controller checker above is
 	// unchanged and keeps running until the slice-10 cutover). Same 60s cadence.
 	hostStalenessChecker := monitor.NewHostStalenessChecker(dataStore, staleThreshold, dispatcher.ProcessEvent, logger)
+	// v0.44.0-agent: operator alert when an agent reports a degraded privileged capability (a missing
+	// `sudo -n` grant — the 2026-06-28 cutover class). Same 60s sweep + transition/cooldown plumbing.
+	hostCapabilityChecker := monitor.NewHostCapabilityChecker(dataStore, dispatcher.ProcessEvent, logger)
 	go func() {
 		ticker := time.NewTicker(60 * time.Second)
 		defer ticker.Stop()
@@ -326,6 +329,7 @@ func main() {
 			case <-ticker.C:
 				stalenessChecker.Check()
 				hostStalenessChecker.Check()
+				hostCapabilityChecker.Check()
 			}
 		}
 	}()