hub v0.46.0: observability pass — per-box log pulls, bundle custody, 72h TTL + secret gate

log_bundle_requests + log_bundles store (gzip, newest-3, 72h TTL purged on the
60s sweep); SaveLogBundle secret gate fail-closed (blocked flag row, no payload;
REDACTED/checksums pass). Report ACK gains controller_log_requested + ingests
controller_log_tail; heartbeat envelope gains log_tail_requested + ingests
log_tail (consume-once on arrival; pre-0.83 agents stay visibly pending). Host
detail Diagnostics section: request buttons (controller/agent), state rows with
honest latency hints, View/Download endpoint. Red-proofs: gate disabled and
clear-on-arrival removed both FAIL their tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/cmd/hub/main.go

@@ -448,6 +448,12 @@ func main() {
 				hostMgmtPlaneChecker.Check()
 				hostOOBChecker.Check()
 				offsiteChecker.Check()
+				// v0.46.0: pulled log bundles are transient diagnostics — 72 h TTL.
+				if n, perr := dataStore.PurgeExpiredLogBundles(time.Now()); perr != nil {
+					logger.Printf("[WARN] log-bundle TTL purge failed: %v", perr)
+				} else if n > 0 {
+					logger.Printf("[INFO] log-bundle TTL purge: %d expired bundle(s) dropped", n)
+				}
 			}
 		}
 	}()