controller v0.196.0: the recovered key installs itself (R-200 plumbing half) -- MinAgent 0.125.0

--recover-offsite-install is the sibling of --recover-offsite-check: same fetch/unseal path
through the agent, same STDIN discipline for R, but it PLACES the recovered repository
password via InjectOffboxPassword so a rebuilt box reopens the history it inherited.

Doing this by hand would put the offsite DATA key through a terminal, a clipboard and shell
history. In-process the value goes agent -> this process -> the 0600 file and is rendered
nowhere.

The confirmation is a SECOND invocation: without --confirm-install it prints both hashes and
writes nothing, so the operator sees the comparison before any write is possible.

Three outcomes, named distinctly: installed (no local password -- the rebuilt-box shape),
unchanged (identical key already present, nothing written), refused (a DIFFERENT key present;
installing would clobber the key the current repository is encrypted under, and no force
option is offered). Exit 2 for the refusal, distinct from 1 for a failed step.

Red-proof: removing the confirmation gate makes the dry run write, failing the test. The
R-persistence test carries a positive control -- a planted copy is found, then removed and not
found -- because an absence check is worth only what its sensitivity is.

CHANGELOG.md

@@ -1,3 +1,35 @@
+## v0.196.0 — the recovered key installs itself (2026-08-04, R-200 plumbing half) — MinAgent 0.125.0
+
+`--recover-offsite-install` is the sibling of `--recover-offsite-check`: same fetch → unseal → extract
+through the agent, same STDIN discipline for R, but it **places** the recovered repository password via
+`InjectOffboxPassword` so a rebuilt box reopens the off-site history it inherited.
+
+**Why this is code and not a manual step.** The alternative is recovering the password, reading it off
+a terminal and pasting it into the injection endpoint by hand — which puts the offsite DATA key through
+a human's screen, clipboard and shell history. In-process, the value goes agent → this process → the
+0600 file and is rendered nowhere.
+
+**The confirmation is a second invocation, on purpose.** Without `--confirm-install` it prints both
+hashes and writes nothing, so the operator sees the comparison before any write is possible. A single
+interactive prompt would have had to share stdin with R.
+
+**Three outcomes, named distinctly**, because "it did nothing" and "it refused" are different facts:
+**installed** (no local password — the rebuilt-box shape), **unchanged** (identical key already present,
+nothing written), **refused** (a DIFFERENT key present — installing would clobber the key the current
+repository is encrypted under, and which history to keep is not this command's decision; no force
+option is offered). Exit `2` for the refusal, distinct from `1` for a step that failed.
+
+The install re-reads the file afterwards rather than trusting the write — the observable is the file's
+state, not the call's return.
+
+**Red-proof observed:** removing the confirmation gate makes the dry run write the password and fails
+`TestRecoverAndInstall_InstallsOnABareBox`. The R-persistence test carries a **positive control** — a
+planted copy of the code is found by the sweep, then removed and not found — because an absence check
+is worth only what its sensitivity is.
+
+**Nothing customer-facing:** no page, no card, no form. `ensureOffboxRepo` and the orphan classifier
+are untouched.
+
 ## v0.195.0 — prove the offsite key comes back (2026-08-04, R-200 plumbing half) — MinAgent 0.125.0
 
 **The question, answered for the first time: is the offsite repository password actually recoverable