Wire the gateway's own State Hub reporting (GLAS-WP-0002-T03)

hub.py mirrors the two reins' hub.py under author: agt-glas-harness.
run_task_through_rein gains report_to_hub (default True), posting one
gateway_run progress event from a finally block -- fires on both
success and failure, giving the gateway an audit trail independent of
whatever the rein itself reports. cli.py gained a matching --no-hub
flag.

Live-verified: ran a real task through ReinOpenWeights with hub
reporting enabled, confirmed the gateway_run event landed with correct
detail and a real commit sha. 4 new tests, 23/23 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/glas_harness/hub.py

@@ -0,0 +1,44 @@
+"""Custodian State Hub reporting (REST, no MCP) — the gateway's own audit trail.
+
+Mirrors rein-aharness's/rein-openweights's hub.py, but under glas-harness's
+own actor attribution. Both reins' CLIs are invoked with their own hub
+reporting disabled (`--no-hub`) by their glas-harness adapters — this
+module is what makes the gateway's audit trail exist independent of
+which rein ran (GLAS-WP-0002-T03).
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Any
+
+import httpx
+
+_DEFAULT_URL = "http://127.0.0.1:8000"
+_TIMEOUT = 10.0
+
+
+def _base_url() -> str:
+    return os.environ.get("STATE_HUB_URL", _DEFAULT_URL).rstrip("/")
+
+
+def post_progress_event(
+    summary: str,
+    event_type: str,
+    detail: dict[str, Any],
+    task_id: str | None = None,
+) -> bool:
+    payload: dict[str, Any] = {
+        "summary": summary,
+        "event_type": event_type,
+        "detail": detail,
+        "author": "agt-glas-harness",
+    }
+    if task_id:
+        payload["task_id"] = task_id
+    try:
+        resp = httpx.post(f"{_base_url()}/progress/", json=payload, timeout=_TIMEOUT)
+        resp.raise_for_status()
+        return True
+    except httpx.HTTPError:
+        return False