hub v0.16.0: seed artifact manifest from env; manifests image -> 0.16.0

- cmd/hub/main.go: seed the Day-0 artifact manifest from ARTIFACT_AGENT_VERSION/
  ARTIFACT_AGENT_SHA256/ARTIFACT_GOLDEN_VERSION/ARTIFACT_GOLDEN_SHA256 on startup
  (only empty fields, so UI edits stick) — same escape hatch the floor uses.
- manifests/hub.yaml: image 0.15.0 -> 0.16.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/cmd/hub/main.go

@@ -113,6 +113,47 @@ func main() {
 		logger.Printf("[INFO] Default controller-version floor: %s", cfg.ControllerUpdates.DefaultMinVersion)
 	}
 
+	// BUNDLE slice: seed the Day-0 artifact manifest from env (ARTIFACT_AGENT_VERSION /
+	// ARTIFACT_AGENT_SHA256 / ARTIFACT_GOLDEN_VERSION / ARTIFACT_GOLDEN_SHA256). The operator UI is the
+	// primary editor, but the UI is password-gated, so env-seeding is the same escape hatch the floor
+	// uses. Seed ONLY fields the DB doesn't already have, so a UI edit sticks across restarts and a
+	// fresh install still gets values from the deployment env.
+	{
+		m := dataStore.GetArtifactManifest()
+		changed := false
+		if m.AgentVersion == "" {
+			if v := os.Getenv("ARTIFACT_AGENT_VERSION"); v != "" {
+				m.AgentVersion = v
+				changed = true
+			}
+		}
+		if m.AgentSHA256 == "" {
+			if v := os.Getenv("ARTIFACT_AGENT_SHA256"); v != "" {
+				m.AgentSHA256 = v
+				changed = true
+			}
+		}
+		if m.GoldenVersion == "" {
+			if v := os.Getenv("ARTIFACT_GOLDEN_VERSION"); v != "" {
+				m.GoldenVersion = v
+				changed = true
+			}
+		}
+		if m.GoldenSHA256 == "" {
+			if v := os.Getenv("ARTIFACT_GOLDEN_SHA256"); v != "" {
+				m.GoldenSHA256 = v
+				changed = true
+			}
+		}
+		if changed {
+			if err := dataStore.SetArtifactManifest(m); err != nil {
+				logger.Printf("[WARN] Failed to seed artifact manifest from env: %v", err)
+			} else {
+				logger.Printf("[INFO] Artifact manifest seeded from env: agent=%s golden=%s", m.AgentVersion, m.GoldenVersion)
+			}
+		}
+	}
+
 	// Parse stale threshold
 	staleThreshold, err := time.ParseDuration(cfg.Alerting.StaleThreshold)
 	if err != nil {