hub v0.44.0: PBS DR tier SLICE 1 — felhom-tenantsync surface (script+client) + hub provisioning flow (consume-once host secret, pbs_dr desired-state descriptor, fail-closed + idempotent, re-issue)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

manifests/hub.yaml

@@ -171,6 +171,11 @@ spec:
                   name: wg-endpoint-ssh
                   key: hostkey
                   optional: true
+            # PBS DR tier (SLICE 1): the tenantsync channel — same endpoint + pinned host key as
+            # peersync (env above), its OWN private key from Secret/tenantsync (out-of-band,
+            # runbook offsite-endpoint.md §10). Optional: absent → the hub logs tenantsync disabled.
+            - name: TENANTSYNC_SSH_KEY_FILE
+              value: "/etc/hub-secrets/tenantsync/key"
             # Offsite provisioning (SLICE 1+2): Hetzner Storage Box API token + the NUMERIC id of the
             # pool box, from the out-of-band Secret/storagebox (NOT committed). The token MUST be scoped
             # to the dedicated storage project — NEVER the shared-project token (it can touch ep0).
@@ -206,6 +211,9 @@ spec:
             - name: wg-endpoint-ssh
               mountPath: /etc/hub-secrets/wg-endpoint-ssh
               readOnly: true
+            - name: tenantsync
+              mountPath: /etc/hub-secrets/tenantsync
+              readOnly: true
           livenessProbe:
             httpGet:
               path: /healthz
@@ -235,6 +243,14 @@ spec:
               - key: key
                 path: key
                 mode: 0400
+        - name: tenantsync
+          secret:
+            secretName: tenantsync
+            optional: true
+            items:
+              - key: key
+                path: key
+                mode: 0400
 
 # =============================================================================
 # SERVICE