agent v0.36.7: isolate shared parent only on create (no peer-group churn)

make-private+make-shared only when first creating the self-bind; re-running it
churns the peer group and orphans the guest's slave (propagation dies).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to **felhom-agent** are recorded here. Update on every code
 change that gets pushed.
 
+## v0.36.7 — isolate the shared parent only on CREATE (no peer-group churn) (2026-06-15)
+
+Follow-up to v0.36.6: make-private+make-shared must run ONLY when the self-bind is first created, not on
+every reconcile — re-doing it churns the peer-group id and ORPHANS the guest`s already-established slave
+(propagation silently dies, guest sees empty). Guarded on the mountpoint check; on a fresh boot it runs
+once before pve-guests so the guest slaves the right group.
+
 ## v0.36.6 — shared parent gets its OWN peer group (make-private first) — ROOT CAUSE of double-bind (2026-06-15)
 
 The shared-parent self-bind INHERITED the root mount`s shared peer group (`/mnt/felhom-drives` was