F-LEAK: remove the pool-adoption fix — refuted live; the fix is a path-scoped ACL (v0.108.0)

PUT /pools/{pool} ALSO requires VM.Allocate on the VM being added, so Pool.Allocate
cannot bootstrap its own membership. Proven live on demo-hp 2026-07-28. The real fix is
felhom-host-install v1.21.0 granting FelhomAgentGuest at /vms/990000..990009.

CHANGELOG.md

@@ -1,5 +1,34 @@
 # felhom-agent — Changelog
 
+## v0.108.0 — F-LEAK: the pool-adoption fix was WRONG; the fix is a path-scoped ACL (2026-07-28)
+
+**A correction, made because the live replay refuted the design.** v0.107.0 shipped a scratch-teardown
+fallback that, on a 403, adopted the stranded guest into the `felhom` pool and retried the destroy —
+reasoning that the token holds `Pool.Allocate` on `/pool/felhom`. The live replay on demo-hp fired
+that path exactly as designed and PVE refused it:
+
+```
+WARN  restore-test: scratch teardown failed — adopting the stranded scratch ... vmid=990000 pool=felhom
+ERROR restore-test: pool adoption failed; left for Recover  vmid=990000
+      err="proxmox: PUT /pools/felhom -> HTTP 500: permission denied at /vms/990000 (missing privilege ...)"
+```
+
+`PUT /pools/{pool}` **also** requires `VM.Allocate` on the VM being added — the very privilege the
+403 was about. **Pool membership cannot bootstrap its own authority.** The adoption code and its
+guard (`scratchAdoptAllowed`) are removed; a path that provably cannot work should not ship, and
+leaving it would have left a plausible-looking fix in place of a real one.
+
+**The actual fix lives in `felhom-host-install.sh` v1.21.0**: the `FelhomAgentGuest` role is now
+granted at each `/vms/990000`…`/vms/990009` path — the restore-test's scratch band. PVE ACLs are
+path-scoped, so this authorises the agent on exactly those ten IDs. It is **not** granted at `/vms`,
+which would authorise destroying every guest on the box.
+
+Proven live on demo-hp: `/vms/990000` → **has** `VM.Allocate` (13 privs); `/vms/100`, `/vms/9999` and
+`/vms/990010` (one past the band) → **no** `VM.Allocate` (3 privs, base only).
+
+Code side keeps only the corrected diagnostic on the teardown-failure branch, which now records what
+the 403 means and that adoption was tried and refused — so the next reader does not re-derive it.
+
 ## v0.107.0 — F-REBOOT + F-LEAK: the agent's authority over guest lifecycle (2026-07-28)
 
 Two Campaign 8 findings, both about the agent being unable to act on a guest it owns.