docs: felhom.eu REPORT (HostLeafChecker) + hub README + self-health arc complete (spike doc)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

hub/README.md

@@ -109,6 +109,13 @@ Events are the primary monitoring mechanism. Each event has: customer_id, event_
 
 **Hub-generated events** (source="hub"):
 - `node_stale` / `node_down` / `node_recovered` — dead man's switch from staleness checker (every 60s)
+- `host_stale` / `host_down` / `host_recovered` — host-domain dead man's switch (agent host reports)
+- `agent_capability_degraded` / `agent_capability_recovered` — `HostCapabilityChecker`: an agent's
+  required `sudo -n` grant went missing (the non-root cutover class)
+- `host_leaf_changed` — `HostLeafChecker` (`monitor/host_leaf.go`, every 60s): an agent's reported
+  local-API **leaf fingerprint** changed (an agent re-key) — proactive, fleet-wide, independent of any
+  controller's channel-health check. Trust-on-first-report baseline; empty fp = unknown (never alerts).
+  Reads the fp from the latest host-report (`store.GetHostLeafFingerprints`, no schema migration).
 - `expected_backup_missed` / `expected_dbdump_missed` — backup deadline checker (daily at 05:00 Budapest)
 
 ### Notifications