docs: REPORT + README for v0.47.0 F1 verify hardening (live rollback re-test PASS)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

README.md

@@ -178,6 +178,13 @@ pre-pulls the target image then calls the agent:
   write `/etc/felhom-controller-image` → `systemctl restart felhom-controller-bootstrap.service` → poll
   the new controller to healthy (`docker inspect`, ≤90s) → **roll back** to the previous image if not (the
   guest is never left without a controller). Strict image-ref gate; single-flight per guest (409).
+  - **(v0.47.0) Verify hardening (F1):** the health poll reads `{{.RestartCount}}` (a 4th inspect
+    field) — `running && RestartCount>0` is **not** healthy (a process that already crash-restarted
+    isn't stably up), and a **no-healthcheck** image must report ok on 3 **consecutive** polls (a
+    stability dwell) before acceptance; a real `healthy` result is trusted immediately. This closes the
+    hole where a no-HEALTHCHECK image that crash-loops could land one "Running" instant and false-pass
+    the point-in-time check → no rollback. Verify predicate only — the rollback orchestration + the
+    `docker inspect -f *` grant (the `*` spans the extended template) are unchanged.
 - `GET /controller/swap/status` → `{state, current, previous, target, error}`.
 
 The agent is **external** to the controller container, so it survives the controller being killed