docs: record hub 0.66.0 self-bind live validation (R-27 slice 1)

Live through the real ingress: public /bind/ renders logged-out with the
no-oracle expired state (200-not-500 proves selfbind_tokens migrated);
gate intact (/ and /hosts -> /login); CSRF exemption is /bind/-only
(POST /bind/ no-CSRF 200 vs POST /customers/x/block no-CSRF 302).
Operator-minted full walk + new-ISO console banner remain operator/R-1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017qDiBqKKQ5vPB5fXBqu7Kp

CONTEXT.md

@@ -21,8 +21,14 @@
   **GC verdict:** no appliance-staleness GC exists (`applianceStaleAfter` is a display badge only) → the
   7-day token TTL stands alone, single-active-per-customer, no reaper needed. **Controller/agent
   untouched; R-27b (controller second-box dismissable prompt) DEFERRED, mechanism sketched.** Green:
-  full hub `build/vet/test` (17 ok, +9 self-bind tests) + `bash -n`. **LIVE validation pending deploy
-  (this session).** See REPORT.md.
+  full hub `build/vet/test` (17 ok, +9 self-bind tests) + `bash -n`. **DEPLOYED + LIVE (hub 0.66.0 on
+  k3s, Synced/Healthy).** Live through the real ingress: `GET /bind/<garbage>` → 200 Hungarian expired
+  page (public, logged-out, no-oracle — the 200-not-500 proves `selfbind_tokens` migrated live); `/` +
+  `/hosts` → 302 /login (gate intact); `POST /bind/<garbage>` no-CSRF → 200 (exempt) while
+  `POST /customers/acme/block` no-CSRF → 302 /login (exemption is `/bind/`-only). **PENDING
+  (operator-gated, NOT-live):** operator "Send self-bind link" + the customer's real two-factor success
+  (hub UI password-gated → CC can't log in) + the new-ISO console banner on a re-imaged box → fold into
+  the R-1 rehearsal. See REPORT.md.
 
 - **2026-07-17 — PBS DR STORAGE VISIBILITY + Offsite tab split + dual gauges shipped (hub v0.65.0 +
   tenantsync v1.2.0, R-5), LIVE.** Scoping correction (Viktor): "restic box" and "PBS box" are NOT two