## 2026-09-28T07:28:00Z golden 0.276.0 — bake in the drill VM (RUNBOOK-manual-build §4.0/§4.1)
  reverted to virgin (this also proves no qemu holds the qcow2)
  cold boot started
  ssh up: pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve)
system          debian-13-standard_13.6-1_amd64.tar.zst
system          debian-13-standard_13.6-1_arm64.tar.zst
  template (current point release, listed not assumed): debian-13-standard_13.6-1_amd64.tar.zst
  template downloaded
  script (v3.0.0) + token landed, non-empty, executable
  bake launched 2026-09-28T07:28:45Z  (GITEA_USER=admin)
  token leak check on the unit (needle proven non-empty, so the grep cannot match everything): 0
  unit state: inactive at 2026-09-28T07:34:30Z
  log copied off the machine FIRST: 322 lines
  markers: overlay2=1 mountpoints=2 upload=1 FATAL=0 excluding=0
      docker OK (overlay2; data-root /var/lib/docker)
    INFO: including mount point rootfs ('/') in backup
    INFO: including mount point mp0 ('/var/lib/felhom') in backup
    [golden]   upload OK (HTTP 201)
GOLDEN_VERSION=0.276.0
GOLDEN_SHA256=d8e273930953f400afa62b356753d4a99fd9a330cf174436c7096a2307cc4a23
  token-leak grep on the saved log: 0
  positive control (token appended to a throwaway copy): 1
  REGISTRY CHECK (the outcome, not the attempt): golden 0.276.0 -> http=206
  secrets shredded (3 expected absent): 3
  pct list lines after destroy: 0
  qemu processes: 0
  registry=206; guest destroyed, qemu exited, disk reverted to virgin
  PUBLISHED
## bake finished 2026-09-28T07:34:55Z
## 2026-09-28T07:35:04Z anonymous full download (what a fresh box does, no auth header)
http=200 bytes=654383234
d8e273930953f400afa62b356753d4a99fd9a330cf174436c7096a2307cc4a23  golden.tar.zst
