iso v1.26.0: the PUBLIC release image — no answer file, interactive install, day-0 by .deb

Design inputs: SPIKE-universal-iso-{1,2,3,4}-2026-07-31.md. Every choice below is a measurement.

NEW: scripts/iso/pkg/ — the felhom-bootstrap .deb, built from committed source.
  Two files only (script + unit), NOT three: felhom-bootstrap.sh:91 reads /etc/felhom/bootstrap.env
  only 'if [[ -r ]]', and its defaults at :95-96 are EXACTLY what the pairing env set
  (build-felhom-iso.sh:257-258) — so shipping it would add a 0600 file to a public package to express
  values the script already defaults to. NO dependencies: the binaries it calls run at FIRST BOOT,
  not at postinst time, so SPIKE 4's open 'dpkg --configure -a' ordering question does not arise.
  The postinst is structurally incapable of failing (no 'set -e', every statement guarded, ends
  'exit 0'); build-deb.sh self-asserts G8/G9 and REFUSES to emit a package that violates them.

iso-repack.sh — two changes, both narrowing rather than deleting:
  - R-155 guard: now applies to FELHOM_MENU=single ONLY. It protected the single-entry mode's promise
    (one button labelled 'install' must not drop into a disk-picker); a release image carries no
    auto-installer-mode.toml BY DESIGN (gate G1), so refusing it would be the guard firing on the
    shape it describes rather than the one it prevents.
  - the menu collapse now has a release mode: two INTERACTIVE entries, Graphical default, timeout 15.
    Entry-count and banned-token gates are per-mode; the six-token list is UNCHANGED for single mode.
  - .deb injection into /proxmox/packages/, with a skip-list collision check (a colliding name would
    be dropped silently — the inert-payload class) and a post-remaster assertion that it landed in
    final.iso, not merely in the extract tree.

build-felhom-iso.sh — --release: no profile, no root hash, no answer.toml, no prepare-iso at all.
  Skipping prepare-iso is what removes the Automated entry by construction, since the stock grub.cfg
  emits it only inside 'if [ -f auto-installer-mode.toml ]'.

R-128 RULING — FIXED, by correcting the claim rather than inventing an assertion for it. The comment
  said ISO_VERSION 'aligns with SCRIPT_VERSION'; nothing evaluated it and the two had drifted. The
  coupling does not exist: the ISO is frozen, felhom-host-install.sh is fetched at run time from main
  (R-94/R-110), so an assertion would invent a constraint. Comment corrected, ISO_VERSION -> 1.26.0.

Release gate G6 AMENDED before the build, with its reasoning recorded in the runbook: the six-token
  ban existed to keep users away from the manual installer, which the ruling makes the product.
  'proxtui' (the TUI installer we ship) and 'nomodeset' (its graphics fallback) are dropped for
  release images; proxdebug/Rescue Boot/memtest/fwsetup stay banned in both modes.

documentation/runbooks/iso-release-gate.md

@@ -100,13 +100,32 @@ install paths on unfamiliar hardware needs to read them first. *Why the spelling
 writes `timeout-style`, which GRUB does not recognise as a variable name at all (Spike 2 §5.2) —
 Felhom's underscore form is the one that works.
 
-**Also assert the safety property still holds** — no live route to a manual disk-picker via a debug or
-rescue entry:
+**Also assert the safety property still holds:**
 
 ```bash
-grep -v '^[[:space:]]*#' /tmp/g.cfg | grep -cE 'proxtui|proxdebug|nomodeset|Rescue Boot|memtest|fwsetup'
+grep -v '^[[:space:]]*#' /tmp/g.cfg | grep -cE 'proxdebug|Rescue Boot|memtest|fwsetup'
 ```
-**PASS = `0`.** This is the gate `iso-repack.sh:160-164` already enforces and it is kept unchanged.
+**PASS = `0`.**
+
+> **Amendment, 2026-07-31, before the first build — recorded rather than made quietly.**
+> This criterion was first written as the six-token list `iso-repack.sh:160-164` enforces
+> (`proxtui|proxdebug|nomodeset|Rescue Boot|memtest|fwsetup`), on the stated rationale *"no live route
+> to a manual disk-picker"*. **That rationale is obsolete for a public image and was already obsolete
+> when it was written.** The operator's ruling makes the manual installer *the product*: the person
+> installing chooses their own disk in the stock installer, which shows the target and a `Bootdisk(s)`
+> summary before erasing. A token list whose purpose is to keep users away from the manual installer
+> cannot be applied to an image whose purpose is to offer it.
+>
+> Two tokens are therefore dropped **for the release image only**:
+> - **`proxtui`** — it is the Terminal UI *installer*, one of the two entries the image deliberately
+>   ships; and
+> - **`nomodeset`** — a graphics fallback for the same installer, needed on hardware whose GPU the
+>   default mode cannot drive.
+>
+> **Four are kept, and they are the ones that were ever the real hazard:** `proxdebug` (drops to a
+> shell), `Rescue Boot` (boots an existing system rather than installing), `memtest` and `fwsetup`
+> (not installers at all). The original six-token gate remains **unchanged** for the single-entry
+> appliance mode, where its original rationale still holds exactly.
 
 ### G7 — The Felhom package is present, at a recorded version