hub v0.130.0: OS updates, guest fast lane — rings, per-box switch, OS releases approved from ring 0, os-report, os_update desired block

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/notify/dispatcher.go

@@ -680,6 +680,13 @@ var operatorOnlyEvents = map[string]bool{
 	"offsite_prune_guard_refused": true,
 	// R-833 (v0.129.0): the operator raised ONE window's removal cap — an operator act, logged.
 	"offsite_window_large_grant": true,
+	// OS updates (hub v0.130.0, `11` §8 step 2): run failures, rings, switches and approvals are operator facts.
+	// os_update_applied is deliberately NOT here — it is the household's one line (info: recorded, never mailed).
+	"os_update_failed":           true,
+	"os_update_health_failed":    true,
+	"os_release_approved":        true,
+	"os_release_approved_now":    true,
+	"os_update_settings_changed": true,
 	// R-197 (v0.93.0). "The sealed offsite repository key changed" is a custody fact about escrow
 	// blobs. A customer can take no action on it — the remedy is the operator's inspection of the
 	// off-site tier — and the text is operator-grade English naming host ids and retained-blob