hub v0.41.0: OffsiteChecker (fill 90/95 + staleness >48h) + operator freeze lever (SLICE 4)

Sibling checker over the controller report's offsite object: quota-fill
warn/crit + the silently-stuck staleness detector (escrowed-only,
red-proofed; nil-safe on pre-v0.109 reports; same-second tie-guard).
SetOffsiteFrozen flips ONLY readonly on the exactly-1 labelled sub-account
(SSH preserved); Freeze/Unfreeze buttons — manual only, never automatic.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/cmd/hub/main.go

@@ -404,6 +404,10 @@ func main() {
 	// TASK H1: alert when a host's OPERATOR ACCESS is degraded — felhom-sshd down (with the operator
 	// peer configured) or its config invalid. Transition-based, same 60s sweep.
 	hostOOBChecker := monitor.NewHostOOBChecker(dataStore, dispatcher.ProcessEvent, logger)
+	// SLICE 4: offsite backup health from the controller report's `offsite` object — soft-quota fill
+	// (90/95% of quota_gb) + staleness (enabled+escrowed but no run >48h — the silently-stuck detector;
+	// run FAILURES already alert via backup_failed). Nil-safe on pre-v0.109 reports. Same sweep.
+	offsiteChecker := monitor.NewOffsiteChecker(dataStore, 0, dispatcher.ProcessEvent, logger)
 	go func() {
 		ticker := time.NewTicker(60 * time.Second)
 		defer ticker.Stop()
@@ -420,6 +424,7 @@ func main() {
 				storageFillChecker.Check()
 				hostMgmtPlaneChecker.Check()
 				hostOOBChecker.Check()
+				offsiteChecker.Check()
 			}
 		}
 	}()