hub v0.130.0: OS updates, guest fast lane — rings, per-box switch, OS releases approved from ring 0, os-report, os_update desired block

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/web/server.go

@@ -73,6 +73,7 @@ type Server struct {
 	// offsiteWindowAdmin: operator one-shot grant / weekly switch (decision 68). nil → 503.
 	offsiteWindowGrant  func(customerID string) error
 	offsiteWindowGrantMax func(customerID string, maxRemove int) error
+	osUpdates             OSUpdateAdmin
 	offsiteWindowSwitch func(on bool) error
 	// operator key-file clean-up (decision 72) and abandonment cancel (decision 74). nil → 503.
 	offsiteRemoveUnpinned func(ctx context.Context, customerID string) (int, error)
@@ -212,6 +213,17 @@ func (s *Server) SetOffsiteKeyAdmin(remove func(context.Context, string) (int, e
 	s.offsiteRemoveUnpinned, s.offsiteAbandonCancel = remove, cancel
 }
 
+// OSUpdateAdmin is the operator side of the guest fast lane (hub v0.130.0).
+type OSUpdateAdmin interface {
+	SetRing(hostID string, ring int) error
+	SetEnabled(hostID string, on bool) error
+	ApproveNow() (string, error)
+	FleetJSON() (any, error)
+}
+
+// SetOSUpdateAdmin wires the OS-update operator routes.
+func (s *Server) SetOSUpdateAdmin(a OSUpdateAdmin) { s.osUpdates = a }
+
 // SetOffsiteWindowLargeGrant wires the operator's one-window raised cap (R-833).
 func (s *Server) SetOffsiteWindowLargeGrant(fn func(string, int) error) { s.offsiteWindowGrantMax = fn }
 
@@ -681,6 +693,9 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		}
 		w.Header().Set("Content-Type", "application/json")
 		_, _ = w.Write([]byte("{\"ok\":true}\n"))
+	case strings.HasPrefix(path, "/os/"):
+		// Operator (hub v0.130.0, `11` §8 step 2): per-box ring and switch, approve now, the fleet lines.
+		s.handleOSAdmin(w, r, path)
 	case path == "/offsite/key-audit":
 		// Operator: run the daily off-site key check now (decision 69). Same code path as the 07:10 job.
 		if r.Method != http.MethodPost {