slice 10A: hub desired-state serving + signed-jobs queue (Down channel) (hub v0.9.0)

Serve operator intent to authenticated hosts: PUT /admin/hosts/{id}/desired-state
(global key) bumps desired_generation; GET /hosts/{id}/desired-state + /jobs are
per-host self-scoped; the host-report envelope now carries the real generation +
has_signed_ops. New signed_jobs table + store methods. Desired-state stored/served
opaquely (agent owns the schema). Cross-repo golden (envelope + desired-state)
byte-identical with felhom-agent; doc 03 §4/§9 updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/internal/api/testdata/control-envelope.golden.json

@@ -0,0 +1,7 @@
+{
+  "status": "ok",
+  "poll_interval_seconds": 900,
+  "blocked": false,
+  "desired_generation": 4,
+  "has_signed_ops": true
+}

hub/internal/api/testdata/desired-state.golden.json

@@ -0,0 +1,23 @@
+{
+  "generation": 4,
+  "desired_state": {
+    "guests": [
+      {
+        "vmid": 100,
+        "run": "running",
+        "spec": { "cores": 2, "memory_bytes": 2147483648, "disk_bytes": 21474836480 },
+        "description": "felhom: acme prod"
+      },
+      {
+        "vmid": 200,
+        "decommission": true
+      }
+    ],
+    "pbs_namespace": "felhom-cust-acme",
+    "restore_directive": {
+      "mode": "guest_loss",
+      "archive": "local:backup/vzdump-lxc-200-2026_06_09-11_00_00.tar.zst",
+      "vmid": 200
+    }
+  }
+}