configs: build-golden.sh v2.0.0 — mandatory controller tag (B5) + bootstrap .path unit (B1)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CHANGELOG.md

@@ -1,3 +1,31 @@
+## configs: build-golden.sh v2.0.0 — mandatory controller tag + bootstrap .path unit (B5 + B1) (2026-07-03)
+
+Golden-bake script only — **no agent code, no binary, no agent version bump** (docs/config
+precedent). Resolves drill findings B5 + B1
+(`felhom.eu/documentation/audits/DRILL-day0-cleanroom-2026-07-03.md` §9) and closes the stale
+backlog note `FOLLOWUP-golden-default-controller-tag.md`.
+
+- **B5 — `CONTROLLER_IMAGE` (arg 6) is now MANDATORY** — the hand-bumped default rotted twice
+  (0.43.0 → 0.85.1 → stale again; 0.85.1 predates the v0.86.0 floor-honoring code, which is why
+  every fresh install needed the manual D.1b update). No 6th arg → die with usage (red-proofed:
+  exits 1 before any `pct` op). Auto-resolving "latest" was rejected — it could bake an unvouched
+  tag.
+- **B1 — baked `felhom-controller-bootstrap.path` unit** (`PathExists=/etc/felhom-bootstrap/
+  bootstrap.json`, enabled next to the service): the service's `ConditionPathExists` is evaluated
+  only at boot, but the agent back-half hot-plugs the bootstrap mount into the already-running
+  guest — the path unit starts the service when the file APPEARS, so the controller deploys with
+  NO reboot (isolated systemd proof + full Day-0 proof on the clean-room drill VM; the installer's
+  v1.9.1 post-provision reboot is now a redundant belt, kept). `RemainAfterExit=yes` on the service
+  prevents re-trigger loops; the service itself stays unchanged.
+- `GOLDEN_SCRIPT_VERSION` (2.0.0) + a `[golden]` provenance line (script version + baked controller
+  tag) now open every bake transcript.
+- Baked + published with controller **0.98.3**: golden `0.98.3` /
+  sha256 `b9a02ef1b6f02b9b58babc4c6aad9cf6c053ebdfba116c78c8e7830de757fd01` (Gitea generic package,
+  201 + sha round-trip). Clean-room validation: bake integrity (mp0+mp1 included), isolated
+  hot-plug proof, full local-golden Day-0 install (first boot = 0.98.3, self-update reports
+  up-to-date, app deploy OK) — evidence:
+  `felhom.eu/documentation/audits/DRILL-golden-098-2026-07-03.md`.
+
 ## v0.63.0 — B3 + B2: fresh-install fixes — token reload-on-miss + guesthook snippets dir (2026-07-03)
 
 The two agent-side gaps the Day-0 clean-room drill surfaced