hub v0.44.0: PBS DR tier SLICE 1 — felhom-tenantsync surface (script+client) + hub provisioning flow (consume-once host secret, pbs_dr desired-state descriptor, fail-closed + idempotent, re-issue)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/store/store.go

@@ -440,6 +440,23 @@ func (s *Store) migrate() error {
 		return err
 	}
 
+	// PBS DR tier (SLICE 1, v0.44.0): the one-time PBS token secret, HOST-scoped — the sibling of
+	// one_time_secrets (customer/controller custody) for host/agent custody. The hub receives the
+	// secret over the tenantsync channel, stores it here, and the AGENT consumes it exactly once
+	// (POST /api/v1/hosts/{id}/pbs/consume-token, per-host key). consumed_at marks it spent; a
+	// re-issue supersedes any unconsumed value. Never logged, never in desired-state/ConfigJSON.
+	_, err = s.db.Exec(`
+		CREATE TABLE IF NOT EXISTS host_pbs_secrets (
+			host_id     TEXT PRIMARY KEY,
+			value       TEXT NOT NULL,
+			created_at  DATETIME NOT NULL DEFAULT (datetime('now')),
+			consumed_at DATETIME
+		);
+	`)
+	if err != nil {
+		return err
+	}
+
 	// v0.43.0 — remote app-log diagnostics. Additive columns on app_log_issues:
 	// context = JSON array of ±5 redacted lines around the FIRST occurrence (first capture
 	// wins — stable repro context, no churn); context_customer = whose box it came from