agent (unreleased): the CA copy keeps its previous root only for the changeover, and is compared exactly (the commit's security review)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -11,8 +11,11 @@ Commit only. Each part can be released alone; none needs release 2b. No `configs
   copy), and its root step has a 90-second deadline (it runs on the start path and inside the report loop). (3) **The
   CA copy keeps its previous certificate behind the new one** (`configs/felhom-os-apply`, mode `pve-ca-copy`): the
   copy was replaced before anything could be proven with the new root, and Proxmox serves its old certificate until
-  pveproxy is reloaded — an agent that restarted in that window had no root that verified it. At most two
-  certificates; the same source is still „same”. `configs/` changes again, so the release needs both signed jobs.
+  pveproxy is reloaded — an agent that restarted in that window had no root that verified it. **Only for the
+  changeover:** at every later run the step makes one handshake to the local Proxmox with the NEW root alone, and
+  drops the previous root as soon as that verifies, or when the previous root is no longer a CA that has not ended.
+  The copy is compared exactly, so nothing the step did not check stays in it. To drop the old root at once by hand
+  (a root changed because it leaked): delete the copy. `configs/` changes again, so the release needs both signed jobs.
   (4) The profile-refresh stanza is built from the wrapper's ANSWER (its record of the last refresh comes back at
   every ask); the record file is a bonus — its folder is root-only on a box where a signed job made it first (read in
   source, not on a box). `rewritten` is absent when not known. (5) A watchdog give-up is forgotten when the guest is