homehub: implement + validate sync, tombstones, manifest, alerts

Tested end-to-end with two throwaway homes against a scratch hub root:
deletion propagation, new-machine join safety, edit-wins-over-delete,
reaping, forget, alert timing. Fixes found by those tests:
 - harvest deletions BEFORE the pull (pull used to undo every deletion)
 - gate attribution on $STATE/seen (a new machine would have tombstoned
   every hub file its peers had just uploaded)
 - active_path probed '+ /dir***' instead of '+ /dir/***' -> every tombstone
   looked out-of-scope, so deletions never applied
 - tombstone excludes must precede includes in the filter (first match wins)
 - rsync must get -e with the deploy key; harvest stderr must not be dropped
 - guard hub sync root that already holds unrelated data (178 G here)
 - scrub credentials out of repo remote URLs before publishing the manifest

config

@@ -9,7 +9,7 @@ HUB_HOST=nas.lue.dk
 # years of NAS files into ~/, and a tombstone could reap unrelated files by name
 # accident. The sync root is a dedicated subtree; .hub/ metadata lives inside it.
 HUB_BASE=/volume1/homes/bl
-HUB_PATH=$HUB_BASE/homehub
+HUB_PATH=${HUB_PATH:-$HUB_BASE/homehub}
 
 # Dedicated, PASSPHRASE-LESS deploy key.  Your id_rsa is passphrase-protected and a
 # systemd *user* unit has no SSH_AUTH_SOCK, so using ~/.ssh/id_rsa here would make
@@ -30,11 +30,11 @@ STATE_ROOT=$HOME/.local/state/homehub
 SHARED_ROOT=$HOME/.local/state/shared
 
 # --- policy knobs -------------------------------------------------------------
-GRACE_DAYS=30           # tombstone age before the hub copy is reaped (§5)
-FRESH_MAX_AGE=86400     # alert if a live machine has not synced in 24 h
-ALIVE_FRESH=10800       # "machine is on" = heartbeat younger than 3 h
-REALERT_AGE=604800      # at most one alert per host per week
-TOMB_LIMIT=100          # refuse to apply more deletions than this in one run
+GRACE_DAYS=${GRACE_DAYS:-30}           # tombstone age before the hub copy is reaped (§5)
+FRESH_MAX_AGE=${FRESH_MAX_AGE:-86400}     # alert if a live machine has not synced in 24 h
+ALIVE_FRESH=${ALIVE_FRESH:-10800}       # "machine is on" = heartbeat younger than 3 h
+REALERT_AGE=${REALERT_AGE:-604800}      # at most one alert per host per week
+TOMB_LIMIT=${TOMB_LIMIT:-100}          # refuse to apply more deletions than this in one run
 WARN_FILES=20000        # dry run warns above this many pending changes
 
 # Where to look for git repos for the class B manifest (DESIGN.md §6).