build-golden v2.1.0 — bake EVERY infra image, asked from the controller

Enabling Megosztás on a fresh box pulled felhom-samba from the registry with
zero feedback — minutes of silent nothing. Observed live, twice.

Cause: this script carried its own hand-maintained array of three image tags,
with a comment telling the reader to keep it in sync with the controller's
internal/infra constants. It drifted the moment a fourth stack was added.
felhom-samba was never added here, so the golden baked 3 of 4.

The fix is structural rather than a fourth copy of the list: it now comes from
the controller image the bake just pulled (--print-infra-images, backed by
infra.Images(), which derives from the pins themselves). The golden bakes
exactly what THAT controller version will request, so the two cannot disagree.

Ordering fix this exposed: docker logout ran immediately after the controller
pull, but felhom-samba is on the same private registry, so the infra loop would
have 401'd. Logout moved after the loop, plus a hard assertion that no
credential remains in the guest before it is archived.

Pre-0.147.0 controllers have no such flag; the bake falls back to the historical
3-image list and says so loudly — the fallback IS the drift-prone thing being
removed, so it must never pass silently.

No agent version bump: build tooling only. Effective at the next golden build;
the current golden is not rebuilt for this.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE

CHANGELOG.md

@@ -1,3 +1,28 @@
+## build tooling — the golden bakes EVERY infra image, asked from the controller (2026-07-19)
+
+**No agent version bump: `configs/build-golden.sh` only (v2.0.0 → v2.1.0). Effective at the NEXT
+golden build — the current golden is NOT rebuilt for this.**
+
+- **The bug, observed live twice.** Enabling Megosztás on a fresh box pulled `felhom-samba` from the
+  registry with zero feedback: minutes of silent nothing. Cause: this script carried its own
+  hand-maintained array of three image tags, with a comment instructing the reader to keep it in sync
+  with the controller's `internal/infra` constants. It drifted the moment a fourth stack was added —
+  `felhom-samba` was never added here, so the golden baked **3 of 4**.
+- **The fix is structural, not another copy.** The list now comes from the controller image the bake
+  just pulled: `docker run --rm <controller> --print-infra-images` (backed by `infra.Images()`, which
+  derives from the pins themselves). The golden therefore bakes exactly what **that** controller
+  version will request, and the two cannot disagree by construction. A controller-side test parses
+  the const block out of the source and fails if a pin is added without reaching `Images()`.
+- **Ordering fix that this exposed.** `docker logout` + `config.json` removal ran immediately after
+  the controller pull. `felhom-samba` lives on the **same private registry**, so the infra loop would
+  have 401'd. The logout moved to **after** the loop, with an added hard assertion that no credential
+  remains in the guest before it is archived — the credential is still never baked.
+- **Fallback, loudly.** A controller older than v0.147.0 has no `--print-infra-images`; the bake falls
+  back to the historical 3-image list and prints three WARN lines saying felhom-samba will not be
+  baked and Megosztás will pull at runtime. The fallback is exactly the drift-prone thing this change
+  removes, so it announces itself rather than passing silently.
+- **ROADMAP:** golden **≥ 0.147.x** carries all four infra images.
+
 ## v0.90.1 — R-39 hotfix: PBS reconcile must not pass `--server` to `pvesm set` (2026-07-18)
 
 **Config-only fix (wrapper + red-proof); the Go binary is unchanged.** Ship the wrapper with the