docs: GL-7 closeout — tester agreement + hub 0.36.0 CHANGELOG/REPORT/CONTEXT + GO-LIVE G7 done

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,28 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-09 — TASK GL-7 SHIPPED: customer-page passphrase hardening + install-command generator
+  (hub v0.36.0, `844fbfa7`; deploy `02c748eb`; LIVE, ArgoCD Synced/Healthy)** — go-live G7/G9/G10/G11.
+  Two coupled, security-first changes to the operator customer page (`customer_unified.html` +
+  `configs.go`). **(1) Passphrase hardening:** the per-customer retrieval passphrase was cleartext
+  twice (visible `#retrieval-pw` + baked into the Option-3 debug curl `X-Retrieval-Password:` header);
+  now masked-by-default with reveal (`toggleSecret`) + copy (`copySecret`), value in `data-secret`
+  (existing model), and the Option-3 command carries a `<YOUR-RETRIEVAL-PASSWORD>` placeholder — no
+  secret in any copyable command. (Zero-secret-in-DOM fetch = noted future follow-up, NOT scoped.)
+  **(2) Install-command generator:** the three hard-coded `<code>` blocks became a client-side builder
+  (vanilla JS, no framework/CDN/network) emitting ONLY real host-install v1.12.0 flags, download-then-
+  run, byo-requires-caps enforced client-side, CustomerID prefilled from the server, JS-off static
+  fallback; the seven dangerous/operator-only flags (`--force`/`--rotate-recovery`/`--enable-oob`/
+  `--remove-golden`/`--uninstall`/`--adopt-pool`/`--rescope-acl`) are never offered as controls. Tests
+  `TestTemplates_PassphraseHardened` + `TestTemplates_InstallGenerator` (green; passphrase test
+  red-proofs). **Tester agreement written** (`documentation/pilot/PETI-tester-agreement.md`): BYO
+  trust boundary, honest limitations (no offsite backup, F2 removable-drive, F7 pool-reassert, F6
+  `:53`-free), exit rights, Peti box facts (80c/128 GB → caps 12/32768, `sajatfelhom.hu` re-point),
+  byo install command, onboarding sequence. GO-LIVE-PACKAGE: GL-7 ✔; G9/G10/G11 → done. **One open
+  pilot question (owned by the agreement §6):** Peti's local backup TARGET — does his box have a
+  second disk/pool? → sets `--acl-storages` at onboarding. Deploy gotcha: first build was stale
+  (local commits not pushed before `build.sh` pulls origin) — pushed then rebuilt. **NEXT: Peti day-0
+  onboarding (operator-run).**
 - **2026-07-08 — TASK GL-8 SHIPPED: BYO coexistence hardening (host-install v1.12.0, `18a556a5`)** —
   the GL-6 findings F3/F6/F1. **F3:** the populated-host leaf guard fires only when a `felhom_guests`
   guest exists (not `pct list`) → a fresh byo install on a host running only the OWNER's guests needs