feat(hub): OOB access health ingest + degraded alert (H1 Part 4)

store.GetHostOOBStates parses the agent oob heartbeat stanza. monitor/host_oob:
transition-based oob_degraded/oob_recovered warning (felhom-sshd down while the
operator peer is configured, OR config invalid) — proactive "can the operator get
in right now" signal; unconfigured OOB never alerts. Wired into the 60s sweep.
Non-hollow tests + transitions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/cmd/hub/main.go

@@ -381,6 +381,9 @@ func main() {
 	// TASK G1: warn when a host's agent-independent watchdog auto-healed a missing /run/sshd privsep
 	// dir — a recurring clobber that can lead to an SSH lockout (complements host_staleness). Same sweep.
 	hostMgmtPlaneChecker := monitor.NewHostMgmtPlaneChecker(dataStore, dispatcher.ProcessEvent, logger)
+	// TASK H1: alert when a host's OPERATOR ACCESS is degraded — felhom-sshd down (with the operator
+	// peer configured) or its config invalid. Transition-based, same 60s sweep.
+	hostOOBChecker := monitor.NewHostOOBChecker(dataStore, dispatcher.ProcessEvent, logger)
 	go func() {
 		ticker := time.NewTicker(60 * time.Second)
 		defer ticker.Stop()
@@ -396,6 +399,7 @@ func main() {
 				hostDiskChecker.Check()
 				storageFillChecker.Check()
 				hostMgmtPlaneChecker.Check()
+				hostOOBChecker.Check()
 			}
 		}
 	}()