CHANGELOG: the fleet runs the published bytes, not the proof build (R-349)

Both boxes were first given a hand build: same source, same version
string, different bytes (256e0829 vs the published a56a92a7), because
release-agent.sh builds with -trimpath -buildvcs=false and a hand build
does not.

Nothing would have corrected it. The boxes already reported 0.130.0, so
self-update saw the vouched version as installed and would have done
nothing, forever. Every version check in the system compares the STRING.

Both reinstalled from the downloaded package; both now report a56a92a7.

CHANGELOG.md

@@ -10,6 +10,13 @@
 > self-update and destroyed the control the proof rested on. **`release-complete` convicted on the
 > release heading and was right to** — the answer was to stop claiming a release, not to bypass the
 > gate. See R-347.
+>
+> **The fleet runs these exact bytes.** Both demo boxes were first given a hand build made during the
+> proof — same source, same version string, **different bytes** (`256e0829…`), because
+> `release-agent.sh` builds with `-trimpath -buildvcs=false` and a hand build does not. Nothing would
+> have corrected that: the boxes already reported `0.130.0`, so self-update saw the vouched version as
+> installed and would have done nothing, forever. Both were reinstalled from the **downloaded package**
+> and now report `a56a92a7…`. Filed as **R-349**, because every prove-then-publish train hits it.
 
 **What was measured, before anything was changed.** Between 2026-08-18 09:51:22Z and 2026-08-20
 08:02:13Z, ep0's PBS proxy accumulated **388 established connections** — 194 from each demo box, on a