R-812 option A (hub): the Proxmox package set — candidate, operator approval, System page

Layer pve: never auto-approved; the candidate is the Proxmox userspace set
every ring-0 box reports (kernel / boot / firmware names left out); the
operator's "Approve Proxmox set" button appears only after 2 healthy night
pve steps on every ring-0 box; an approval nudges no box (ring 1 by a signed
os_pve_step). 11 §5.10 written (BUILT, unreleased, not yet proven live); §8
step 6 split (userspace §5.10, kernel R-836).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/web/os_updates.go

@@ -70,6 +70,15 @@ func (s *Server) handleOSAdmin(w http.ResponseWriter, r *http.Request, path stri
 		}
 		id, err := view.ApproveDocker()
 		reply(map[string]string{"release_id": id}, err)
+	case r.Method == http.MethodPost && path == "/os/approve-pve":
+		// R-812 option A (`09` §3 decision 163): the operator approves the Proxmox package set ring 0 ran.
+		view, ok := s.osUpdates.(OSSystemView)
+		if !ok {
+			reply(nil, fmt.Errorf("proxmox approval not available"))
+			return
+		}
+		id, err := view.ApprovePVE()
+		reply(map[string]string{"release_id": id}, err)
 	default:
 		http.Error(w, "not found", http.StatusNotFound)
 	}