hub v0.59.0: Direction-2a agent-plane immediate-sync poke sender + ep0 felhom-poke surface

- internal/poke: pinned-host-key SSH poke sender (wgsync sibling) + fire-and-forget Notifier (PokeHost/PokeAllHosts). Poke refuses non-WG targets pre-dial; contentless via ep0 forced command to the box WG /32:51822.
- wiring: Server.SetPoke; applyPBSDR pokes the host after each descriptor gen-bump; handleSetArtifacts (MinAgent floor) pokes all hosts. main.go env POKE_SSH_KEY_FILE (reuses peersync endpoint/hostkey).
- scripts/felhom-poke.sh (non-root forced command) + offsite-endpoint.md §11; manifests/hub.yaml Secret/agent-poke + POKE_SSH_KEY_FILE (image tag bump follows the build).

manifests/hub.yaml

@@ -184,6 +184,13 @@ spec:
             # runbook offsite-endpoint.md §10). Optional: absent → the hub logs tenantsync disabled.
             - name: TENANTSYNC_SSH_KEY_FILE
               value: "/etc/hub-secrets/tenantsync/key"
+            # Agent-plane immediate-sync (Direction-2a, v0.59.0): the poke sender — same endpoint +
+            # pinned host key + peersync user as above, its OWN forced-command key from Secret/agent-poke
+            # (out-of-band; the ep0 authorized_keys line carries the PUBLIC half, command="felhom-poke").
+            # Optional: absent → the hub logs the poke disabled; agent-plane saves still reconcile in
+            # ≤15 min. See documentation/runbooks/offsite-endpoint.md (poke section).
+            - name: POKE_SSH_KEY_FILE
+              value: "/etc/hub-secrets/agent-poke/key"
             # Offsite provisioning (SLICE 1+2): Hetzner Storage Box API token + the NUMERIC id of the
             # pool box, from the out-of-band Secret/storagebox (NOT committed). The token MUST be scoped
             # to the dedicated storage project — NEVER the shared-project token (it can touch ep0).
@@ -222,6 +229,9 @@ spec:
             - name: tenantsync
               mountPath: /etc/hub-secrets/tenantsync
               readOnly: true
+            - name: agent-poke
+              mountPath: /etc/hub-secrets/agent-poke
+              readOnly: true
           livenessProbe:
             httpGet:
               path: /healthz
@@ -259,6 +269,14 @@ spec:
               - key: key
                 path: key
                 mode: 0400
+        - name: agent-poke
+          secret:
+            secretName: agent-poke
+            optional: true
+            items:
+              - key: key
+                path: key
+                mode: 0400
 
 # =============================================================================
 # SERVICE