agent v0.175.0: the changelog heading (released, not vouched)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,4 +1,9 @@
-## Unreleased (2026-11-15) — a cut write of `agent.json` cannot leave a blind box (R-1380; found before the release)
+## v0.175.0 (2026-11-15) — trust in Proxmox by a copy of the box's own root CA (R-1380, release 2b); the agent tells the hub its clock, a refused job, a give-up and what a clean-up did (release 3); a boot key a clock step cannot move (R-1395) — RELEASED 2026-11-15 (release-agent.sh from the clean working clone at `db01ae0`, CI run id 2671; agent sha256 d1a30ed51f6663d96369ad3e88c221194af92773addf4fbb48852ee58be4b19a, bundle sha256 3b4a8b78155fc4385148c98c229da2e61e7c6b02bad9ed9f1fdc4a9ea1370d95); NOT vouched yet
+
+`configs/` changed (the wrapper's `pve-ca-copy` mode), so a box needs BOTH signed jobs: `agent_update`, then
+`agent_config_update`. The three sections below were built on 2026-11-14 night and 2026-11-15 morning.
+
+### A cut write of `agent.json` cannot leave a blind box (R-1380; found before the release, 2026-11-15)
 
 - **`config.ReplaceInPlace` + `config.RecoverCutWrite`** (`internal/config/cutwrite.go`). `agent.json` is the agent's
   file in a root-owned folder, so the trust move, the PBS seed and the backup-target move write it in place
@@ -9,7 +14,7 @@
   four steps, the wiring in `main`, and a source pin that the three writers use the helper and open no file by hand.
   Red-proofs: felhom.eu `documentation/audits/release-2b-3-2026-11-15/part0/`. Not proven: a real power cut.
 
-## Unreleased (2026-11-14 night) — release 3 („the hub tells you”) and the clock-step fix, the agent's parts, built and NOT released
+### Release 3 („the hub tells you”) and the clock-step fix, the agent's parts (2026-11-14 night)
 
 Commit only. Each part can be released alone; none needs release 2b. No `configs/` change in this section.
 
@@ -66,7 +71,7 @@ Commit only. Each part can be released alone; none needs release 2b. No `configs
   compares it with its clock and alarms above one minute. Test `TestReport_StampsSentAtAtSending`; 3 mutations seen
   red (felhom.eu `documentation/audits/night-build-2026-11-14/B/redproof-agent-sent-at.txt`).
 
-## Unreleased (2026-11-14 night) — release 2b, built and NOT released: trust in Proxmox by a copy of the box's own root CA (R-1380, D80, felhom.eu `09` §3 decision 303; design `03-host-agent.md` §12a)
+### Release 2b (2026-11-14 night): trust in Proxmox by a copy of the box's own root CA (R-1380, D80, felhom.eu `09` §3 decision 303; design `03-host-agent.md` §12a)
 
 Commit only. No box ran any of this; the proof on a box (demo-hp, a forced new certificate, twice) is the next attended
 session's. `configs/` changes, so the release needs BOTH signed jobs.