Rollback runbook

Steps

1. Stop further writes.
2. Re-run status and capture failing checks.
3. Re-apply last-known-good state through confirm timer.
4. Audit logs and archive artifacts.

Minimal recovery

hubctl status --state-dir /var/lib/vpn-hub
hubctl deploy --confirm-within 5m