CAMPAIGN-3 Task A: agent v0.85.0 boot/recovery plane docs + host-install deployment_mode (--mode gates node self-heal)

network-storage-nas.md gains Boot-ordering (F12), reassert-hardening (F11/F10/F9),
F13 limitation, and Node self-heal (appliance) sections. host-install v1.14.0
templates deployment_mode from --mode + byo assert. Live matrix: host reboot x2 =
0 ordering-cycle lines (F12 dead); appliance self-heal recovered attempt 1.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_017CDMFpFx84pfviCTVuGGhf

scripts/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install v1.14.0 — deployment_mode from --mode (appliance self-heal gate) (2026-07-12)
+
+- The agent-config writer now templates the top-level **`deployment_mode`** field from `--mode`
+  (`appliance` | `byo`), authoritative even over a `--preserve-from` config. It gates the agent's
+  node self-heal (host networking recovery at boot — F12-class defense in depth, agent v0.85.0):
+  only `deployment_mode:"appliance"` unlocks the remedy; anything else, including a stale preserved
+  value or a typo, is byo (the check runs + WARNs, the remedy is unreachable). The byo config assert
+  additionally refuses `deployment_mode=appliance` (a byo box must never carry a host-service
+  self-heal). Companion to CAMPAIGN-3 Task A (`documentation/audits/CAMPAIGN-3-2026-07-11.md`).
+
 ## felhom-host-install v1.13.0 — systemd-journal group for the agent user (NAS verify) (2026-07-11)
 
 - The agent-user setup now adds `felhom-agent` to the **`systemd-journal` group** (idempotent