slice 7: golden host-key unit path fix + live-validation results (v0.8.0)

Live validation on demo-felhom caught the felhom-regen-hostkeys unit failing with
203/EXEC: ExecStart was /usr/sbin/ssh-keygen but on Debian 13 ssh-keygen is at
/usr/bin/ssh-keygen. Fixed build-golden.sh, rebuilt the golden, re-validated — host
keys now regenerate on first boot by the baked unit (agent issues no ssh-keygen).

All three live scenarios green: provision (fresh MAC, host keys via unit, machine-id,
Docker, DHCP), dr (continuity: hostname + host keys preserved), Recover (killed
mid-restore -> orphan rolled back idempotently). REPORT + CHANGELOG updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -53,6 +53,15 @@ transient PVE config-lock 500 → bounded retry).
   not-running fail); F4 (lock-500→retry→proceed; non-lock-500→fail without retry); owning entry
   journaled BEFORE restore; reserved/existing VMID refused; `Recover` rolls back / clean.
 
+### Live-validated (demo-felhom)
+- provision: fresh MAC + hostname; **SSH host keys regenerated by the baked golden unit** (agent
+  issued no `ssh-keygen`), machine-id unique, Docker runs, clean DHCP lease → torn down.
+- dr: continuity preserved (hostname + host keys kept). Recover: a killed mid-restore left an
+  orphan; the re-run's `Recover` rolled it back (idempotent).
+- **Live caught a bug, then fixed:** the host-key unit's `ExecStart` was `/usr/sbin/ssh-keygen`
+  (203/EXEC); on Debian 13 it is `/usr/bin/ssh-keygen` — corrected in `build-golden.sh`, golden
+  rebuilt, re-validated. (Mocked unit tests couldn't surface this; the live run did.)
+
 ## v0.7.0 — restore-test: verdict is liveness, not start-task exitstatus (2026-06-09)
 
 Fixes a correctness bug found by the live hub-enrollment runbook: the self-restore-test reported