GL-2: --mode appliance|byo install profile (host-install v1.10.0) + harness

Mandatory install profile (no default): byo = a host the operator does not
own. Break-glass gated OFF at its call site in byo (root@pam never touched),
mandatory --cores/--memory, argv-time refusals (--enable-oob/--rotate-recovery,
non-9.x PVE, missing --acl-storages), host-mutation disclosure + typed-hostname
ack, byo config asserts (lan_resolver/wg_tunnel/oob off; byo flips the
lan_resolver write default to off), pool+ACL verify asserts in BOTH modes (R2),
--preflight-only (no state, PASS/FAIL verdict), resume mode-mismatch refusal,
FELHOM_INSTALL_STATE_DIR harness override.

NEW scripts/hostinstall-mode-harness.sh: static refusal matrix C1-C4 + grep
invariants + PVE tier (C5 + A/B dry transcripts). 16/16 PASS on felhom-pve
(C5 live); red-proofs RP-1..RP-3 run->fail->revert. shellcheck clean at
severity=warning. Docs: day0-install SC.5 byo section + trust model; REUSE row;
CONTEXT + REPORT. Live drill = GL-6 (supervised); STOP honored (no non-dry run).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

scripts/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install v1.10.0 — --mode appliance|byo install profile (TASK GL-2, go-live G2/G4/G5) (2026-07-07)
+
+- **`--mode appliance|byo` is now REQUIRED** for a fresh install / `--resume` (no default — the
+  build-golden v2.0.0 precedent). `appliance` = the historical behavior, dry-transcript-preserved.
+  `byo` = a Proxmox host the operator does NOT own (the pilot): **`step_break_glass` is gated OFF at
+  its call site** (root@pam never reset, nothing vaulted — the one place the skip is auditable),
+  `--cores` + `--memory` both mandatory (the only noisy-neighbor protection there),
+  `--enable-oob`/`--rotate-recovery` refused at argv time, PVE-major gate (die on non-9.x unless
+  `--force`), every `--acl-storages` entry must exist on the box (die naming ALL missing; appliance
+  warns), informational host-DNS `:53` line, full host-mutation disclosure + typed-hostname
+  acknowledgement (`/dev/tty`, dry-run-aware), and post-write config asserts that refuse
+  `lan_resolver.enable`/`wg_tunnel.enabled`/`oob.enabled` = true (byo also flips the config write's
+  lan_resolver DEFAULT to off; appliance keeps default-on).
+- The old `--mode provision` value is retired (specific die message); the `dr` stub seam is kept.
+  The mode is persisted in state.json; a `--resume` under the other mode refuses (C4).
+- **Verify asserts (BOTH modes — campaign-2 R2 lesson):** the verify step now asserts pool
+  membership of the provisioned vmid + every scoped ACL grant (user AND token: Base@/,
+  Guest@/pool/felhom, Store@each storage); any miss → error + "WITH WARNINGS" verdict.
+- **`--preflight-only`**: runs the full mode-aware step-1 checks, prints an explicit
+  `PRE-FLIGHT PASS/FAIL` verdict, exits 0/1, writes NO state marks (never lets a later `--resume`
+  skip the real preflight). Existing-guest count line added to preflight (both modes).
+- `FELHOM_INSTALL_STATE_DIR` env override (test-harness only) so harness cases can never touch a
+  live `state.json`; `usage()` switched to a marker-based range (the numeric one had drifted).
+- **NEW `scripts/hostinstall-mode-harness.sh`**: static tier (bash -n, shellcheck, C1–C4 refusal
+  matrix asserting exact die messages, grep-invariants: one gated break-glass call site, chpasswd
+  unreachable outside it, --mode in usage) + PVE tier (C5 live-refusal + Scenario A/B dry
+  transcripts via `FELHOM_TEST_CUSTOMER`/`FELHOM_TEST_PASSFILE`). Red-proofs RP-1..RP-3 executed
+  (gate removed / caps requirement dropped / mode-mismatch check dropped → matching case FAILs).
+- Live-validated read-only on felhom-pve: full static tier + C5 + byo dry transcript (no
+  4b/8/chpasswd/recovery-credential; disclosure+ack+DNS+storage lines present) + `--preflight-only`
+  PASS and FAIL verdicts with zero state entries. Full A/B rc=0 transcripts + C7 await the
+  supervised GL-6 drill (blocked today by demo-felhom's EMPTY git.username/git.token — any step-5
+  re-run for that customer dies until the operator sets real Gitea read creds).
+
 ## felhom-host-install — --enable-oob installs the dedicated felhom-sshd OOB instance + belt (TASK H1) (2026-07-05)
 
 - `--enable-oob` + `install_oob` (in step 5): lays down the STATIC OOB parts — `/etc/felhom-sshd` tree