hub v0.130.0: OS updates, guest fast lane — rings, per-box switch, OS releases approved from ring 0, os-report, os_update desired block

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/notify/dispatcher.go

@@ -680,6 +680,13 @@ var operatorOnlyEvents = map[string]bool{
 	"offsite_prune_guard_refused": true,
 	// R-833 (v0.129.0): the operator raised ONE window's removal cap — an operator act, logged.
 	"offsite_window_large_grant": true,
+	// OS updates (hub v0.130.0, `11` §8 step 2): run failures, rings, switches and approvals are operator facts.
+	// os_update_applied is deliberately NOT here — it is the household's one line (info: recorded, never mailed).
+	"os_update_failed":           true,
+	"os_update_health_failed":    true,
+	"os_release_approved":        true,
+	"os_release_approved_now":    true,
+	"os_update_settings_changed": true,
 	// R-197 (v0.93.0). "The sealed offsite repository key changed" is a custody fact about escrow
 	// blobs. A customer can take no action on it — the remedy is the operator's inspection of the
 	// off-site tier — and the text is operator-grade English naming host ids and retained-blob

hub/internal/notify/testdata/mail_goldens/en/customer_event_os_update_applied.txt

@@ -0,0 +1,18 @@
+SUBJECT: [Felhom] Warning: System security fixes were installed on your box. You do not need to do anything.
+---
+Dear Customer,
+
+Your Felhom system sent the following notification:
+
+System security fixes were installed on your box. You do not need to do anything.
+
+Details:
+- Server: demo-fixture
+- Time: 2026-01-15 10:30
+- Level: Warning
+- Type: os_update_applied
+
+If you have any questions, contact your operator.
+
+Best regards,
+Felhom.eu monitoring

hub/internal/notify/testdata/mail_goldens/hu/customer_event_os_update_applied.txt

@@ -0,0 +1,18 @@
+SUBJECT: [Felhom] Figyelmeztetés: Rendszerbiztonsági javítások telepítve a dobozodra. Ehhez nem kell semmit tenned.
+---
+Kedves Ügyfél!
+
+A Felhom rendszered a következő értesítést küldte:
+
+Rendszerbiztonsági javítások telepítve a dobozodra. Ehhez nem kell semmit tenned.
+
+Részletek:
+- Szerver: demo-fixture
+- Időpont: 2026-01-15 10:30
+- Szint: Figyelmeztetés
+- Típus: os_update_applied
+
+Ha kérdésed van, vedd fel a kapcsolatot az üzemeltetővel.
+
+Üdvözlettel,
+Felhom.eu monitoring