docs: hub REPORT (v0.19.0 capability alert) + multidrive audit countermeasure pointer

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

documentation/audits/SPIKE-multidrive-mutual-exclusion-2026-06-29.md

@@ -209,3 +209,10 @@ live parent would orphan the working guest slave — fixed grant takes effect on
 boot). The §7 "guest_attached / pct config" note is **resolved**: `GuestConfig` is a Proxmox **API**
 call, not a sudo CLI command, so `guest_attached=false` is not a sudoers gap (and is benign in the
 intermediary model).
+
+**Durable countermeasure SHIPPED (2026-06-29):** the agent now self-probes its privileged
+capabilities — felhom-agent **v0.44.0** `internal/capability` (build-time manifest⊆sudoers test +
+runtime `sudo -n -l` probe → `HostReport.Capabilities`) + hub **v0.19.0** `HostCapabilityChecker`
+(operator alert on a Critical grant going degraded). This exact incident's missing `lxc-info` grant
+is now a CI build failure and a live `capabilities self-check` degraded signal, not a silent
+multi-day regression. Live: agent reports 40/40 ok. See `felhom-agent/REPORT.md`.