chore(v0.92.1): supersede v0.92.0 — the published artifact predates the sudoers grant

v0.92.0 was published before live verification showed three of the four guestnet probes had
no sudoers grant, so that artifact lacks FELHOM_GUESTNET and the guestnet-* capability rows.
Superseded, not overwritten: a published version stays immutable (the v0.91.0 -> v0.91.1
precedent). Watchdog code is unchanged; the functional fix is the sudoers file, which must
ship with the binary.

CHANGELOG.md

@@ -1,3 +1,14 @@
+## v0.92.1 — ship the guestnet sudoers grant with the binary (supersedes v0.92.0) (2026-07-21)
+
+**Supersedes v0.92.0; that artifact is materially incomplete — do not vouch it.** It was published
+before live verification revealed the watchdog had no sudoers grant for three of its four probes,
+so it carries neither the `FELHOM_GUESTNET` alias nor the `guestnet-*` capability rows that make a
+host missing that alias visible. Left in place rather than overwritten — a published version stays
+immutable (the v0.91.0 → v0.91.1 precedent).
+
+No behaviour change beyond the capability rows; the watchdog code is byte-identical to v0.92.0. The
+functional fix is `configs/felhom-agent.sudoers`, which **must be deployed with the binary**.
+
 ## v0.92.0 — the guest network gets a watchdog (R-54) (2026-07-21)
 
 **Host-tier only — no controller coupling, no wire change the hub must understand today** (the

cmd/felhom-agent/main.go

@@ -58,7 +58,7 @@ import (
 
 // version is the agent version. Overridable at build time with
 // -ldflags "-X main.version=<v>"; defaults to the in-repo CHANGELOG version.
-var version = "0.92.0"
+var version = "0.92.1"
 
 // runGuestHook is the PVE hook body (`felhom-agent guest-hook <vmid> <phase>`). On pre-start it
 // creates placeholder dirs for any absent bind-mount source so the guest always boots (the C1 net);