Wire the gateway's own State Hub reporting (GLAS-WP-0002-T03)

hub.py mirrors the two reins' hub.py under author: agt-glas-harness.
run_task_through_rein gains report_to_hub (default True), posting one
gateway_run progress event from a finally block -- fires on both
success and failure, giving the gateway an audit trail independent of
whatever the rein itself reports. cli.py gained a matching --no-hub
flag.

Live-verified: ran a real task through ReinOpenWeights with hub
reporting enabled, confirmed the gateway_run event landed with correct
detail and a real commit sha. 4 new tests, 23/23 passing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_gateway.py

@@ -1,5 +1,5 @@
 from datetime import UTC, datetime
-from unittest.mock import MagicMock
+from unittest.mock import MagicMock, patch
 
 from sandboxer.models import Reachability, SandboxState, SandboxStatus
 
@@ -54,6 +54,7 @@ def test_run_task_through_rein_creates_and_destroys_sandbox() -> None:
         description="d",
         rein=rein,
         manager=manager,
+        report_to_hub=False,
     )
 
     assert rein.calls == ["start_session", "dispatch_tool", "end_session"]
@@ -81,8 +82,84 @@ def test_run_task_through_rein_destroys_sandbox_even_on_failure() -> None:
             description="d",
             rein=rein,
             manager=manager,
+            report_to_hub=False,
         )
     except RuntimeError:
         pass
 
     manager.destroy.assert_called_once_with("sbx1")
+
+
+def test_run_task_through_rein_reports_success_event() -> None:
+    manager = MagicMock()
+    manager.create.return_value = _fake_status()
+    rein = _FakeRein()
+
+    with patch("glas_harness.gateway.hub.post_progress_event", return_value=True) as post:
+        run_task_through_rein(
+            sandbox_profile="profile.bwrap-local",
+            repo="/tmp/repo",
+            title="t",
+            description="d",
+            rein=rein,
+            manager=manager,
+        )
+
+    post.assert_called_once()
+    kwargs = post.call_args.kwargs
+    assert kwargs["event_type"] == "gateway_run"
+    assert "ok)" in kwargs["summary"]
+    assert kwargs["detail"]["ok"] is True
+    assert kwargs["detail"]["sandbox_id"] == "sbx1"
+    assert kwargs["detail"]["rein"] == "_FakeRein"
+
+
+def test_run_task_through_rein_reports_failure_event_and_still_raises() -> None:
+    manager = MagicMock()
+    manager.create.return_value = _fake_status()
+
+    class _FailingRein(_FakeRein):
+        def dispatch_tool(self, session, tool_call):
+            raise RuntimeError("boom")
+
+    rein = _FailingRein()
+
+    with patch("glas_harness.gateway.hub.post_progress_event", return_value=True) as post:
+        try:
+            run_task_through_rein(
+                sandbox_profile="profile.bwrap-local",
+                repo="/tmp/repo",
+                title="t",
+                description="d",
+                rein=rein,
+                manager=manager,
+            )
+            assert False, "expected RuntimeError to propagate"
+        except RuntimeError:
+            pass
+
+    post.assert_called_once()
+    kwargs = post.call_args.kwargs
+    assert "failed)" in kwargs["summary"]
+    assert kwargs["detail"]["ok"] is False
+    assert kwargs["detail"]["error"] == "boom"
+    assert kwargs["detail"]["result"] is None
+
+
+def test_run_task_through_rein_skips_hub_when_disabled() -> None:
+    manager = MagicMock()
+    manager.create.return_value = _fake_status()
+    rein = _FakeRein()
+
+    with patch("glas_harness.gateway.hub.post_progress_event") as post:
+        run_task_through_rein(
+            sandbox_profile="profile.bwrap-local",
+            repo="/tmp/repo",
+            title="t",
+            description="d",
+            rein=rein,
+            manager=manager,
+            report_to_hub=False,
+        )
+
+    post.assert_not_called()