AUD-56: record the live Hub deploy result

- Five HUB_TOKEN_* keys added to the host secrets file (mode 600, backup kept).
- docker compose up -d --build recreated the hub container on :8788 with the
  AUD-49 image (central-ai-hub:local, sha256:f6b773c8a33a), user 1000:100.
- Verified: /health ok with omniroute ok, control action refused, bad token
  401, container healthy.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docs/outline/04-agent-runbook.md

@@ -242,6 +242,24 @@ file or the running `hub` container.
 | `docker exec <container> /app/hub -healthcheck` | exit 0 (the compose healthcheck) |
 | Container with the image's default `nonroot` user | 401 on `/ask`, `omniroute: unknown` (the finding above) |
 
+### Live deploy result — 2026-10-10
+
+Sam accepted the approval card. The deploy ran from the project folder.
+
+| Step | Result |
+|---|---|
+| `scripts/provision-hub-tokens.sh` | Added 5 keys to the secrets file. Mode 600 kept. Backup `10-secrets.conf.bak.20261010T065304Z`. Values not shown. |
+| `docker compose up -d --build` | Exit 0. Container `hub` recreated and started. |
+| Image | `central-ai-hub:local`, `sha256:f6b773c8a33a` |
+| Container user | `1000:100` |
+| `GET /health` | `ok: true`, `omniroute: ok`, `log: ok` |
+| `POST /ask` `"cut the kids internet"` (`HUB_TOKEN_ESP32`) | `status: "refused"`, `route.kind: "refused"`, `route.reason: "high_consequence_control"` |
+| `POST /ask` with a bad token | HTTP 401 `unauthorized` |
+| `docker inspect hub` | `healthy` |
+
+The control refusal ran with no LLM call, as the `understand/control.go` phrase
+check runs first. The Hub now serves the AUD-49 build on port 8788.
+
 ## After Phase 1
 
 Follow the build order in `AGENTS.md`. Do not start a destination before the