build-golden.sh: default controller image → current (0.85.1); golden rebuilt

The CONTROLLER_IMAGE default (arg 6) was a stale :0.43.0, so an argument-less
golden build baked an ancient controller (fresh Day-0 boxes started at 0.77).
Bumped the default to the current :0.85.1; always pass it explicitly per rebuild.
Golden rebuilt at 0.85.1 on felhom-pve (volid vzdump-lxc-9100-2026_06_27-11_42_51);
baked-image verify confirmed :0.85.1 in the build guest. No agent binary change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FSZmmSFVzGwEzhYmxbkgBK

CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to **felhom-agent** are recorded here. Update on every code
 change that gets pushed.
 
+## build-golden.sh — default controller image bumped to current; golden rebuilt at 0.85.1 (2026-06-27)
+
+**Operational + a default fix (no agent binary change — version stays v0.42.0).**
+
+- `configs/build-golden.sh`: the `CONTROLLER_IMAGE` default (positional arg 6) was a stale
+  `…/felhom-controller:0.43.0` — an argument-less golden build baked a wildly old controller, so fresh
+  Day-0 boxes started old (the demo started at 0.77). Bumped the default to the **current**
+  `…/felhom-controller:0.85.1` so the worst case (no explicit arg) is merely "current", not ancient.
+  - **Always pass the controller version explicitly at each rebuild** — this default only bounds the
+    worst case. A future `make golden` that resolves the latest pullable tag would remove the need for a
+    hand-bumped default (Observation, not this task).
+- **Golden rebuilt at 0.85.1** on `felhom-pve` with the image passed **explicitly**
+  (`build-golden.sh 9100 … gitea.dooplex.hu/admin/felhom-controller:0.85.1`). New archive volid:
+  `local:backup/vzdump-lxc-9100-2026_06_27-11_42_51.tar.zst` (rootfs 32G + Docker-data 16G + user-data
+  8G, all in the archive; mp0+mp1 inclusion confirmed in the vzdump log).
+  - **Baked-image verify (cheap, mandatory):** in the build guest `/etc/felhom-controller-image` =
+    `…:0.85.1` and `docker images` showed it baked (379 MB). New Day-0 provisions now ship current.
+  - The host-bootstrap script auto-discovers the newest golden, so it picks up this rebuild
+    automatically. The real demo 9201 was **not** re-provisioned (it is the Phase-2 floor test box).
+
 ## v0.42.0 — agentic controller update: in-guest image swap + rollback (Phase 1) (2026-06-26)
 
 The host agent now owns the in-guest controller image **swap** — the new-architecture replacement for