Go-live package: Day-0 install runbook + clean-room drill + host-install v1.9.1

- documentation/runbooks/day0-install.md (NEW): operator Day-0 guide, every
  command drill-executed verbatim (Parts A-F incl. the mandatory one-time
  controller update D.1b and the OQ-3 prereq checklist).
- documentation/audits/DRILL-day0-cleanroom-2026-07-03.md (NEW): nested-PVE
  clean-room drill evidence D0-D6, residue tables, OQ-1/2/3 answers, findings
  ledger (B1-B5), go/no-go for Peti (GO).
- scripts/felhom-host-install.sh v1.9.1: residue-free uninstall (agent config,
  shared-parent unit/script/mount, mkfs wrapper, hook snippet, dnsmasq
  snippets; zero-residue diff proven) + post-provision guest reboot (R6) +
  header/version sync.
- CONTEXT.md, REPORT.md, scripts/CHANGELOG.md updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

scripts/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install.sh v1.9.1 — clean-room drill fixes: residue-free uninstall + post-provision reboot (2026-07-03)
+
+Companion to the Day-0 go-live package (`documentation/runbooks/day0-install.md` +
+`documentation/audits/DRILL-day0-cleanroom-2026-07-03.md`). Every fix was found by the clean-room
+drill (virgin nested PVE 9.2.2) and re-verified there (v1.9.1 uninstall → **zero-Felhom-residue
+diff vs the pre-install baseline**; v1.9.1 install → controller up with no manual intervention).
+
+- **Header/version sync** (the header said v1.8.0 while `SCRIPT_VERSION` said 1.9.0); keep-in-sync
+  note on `SCRIPT_VERSION`; usage sed range follows the header (2,95).
+- **Uninstall now removes the drill-found residue (R1–R5):** the agent **config**
+  (resolved from the unit's `-config` BEFORE the unit is removed — it holds the per-host hub
+  api_key), the `felhom-shared-parent` unit + wants links + `/usr/local/sbin/felhom-shared-parent.sh`
+  + the `/mnt/felhom-drives` self-bind/dir, `/usr/local/sbin/felhom-mkfs-guarded`,
+  `/var/lib/vz/snippets/felhom-guest-hook.sh`, and `/etc/dnsmasq.d/felhom-*.conf`
+  (+ dnsmasq restart when touched). All tolerate-absent; summary lines updated (`sudo` AND
+  `dnsmasq` packages are the documented package remnants).
+- **Post-provision guest reboot (R6):** the golden's `felhom-controller-bootstrap.service`
+  evaluates `ConditionPathExists=/etc/felhom-bootstrap/bootstrap.json` at BOOT, but the agent
+  back-half hot-plugs the mount into the running guest — on slower hardware the first boot loses
+  that race deterministically and the controller never deploys. `step_provision` now reboots the
+  guest once (the agent's own output says "next: reboot the guest"); `step_verify` waits bounded
+  (180 s) for the controller container instead of a momentary look.
+
 ## felhom-host-install.sh v1.9.0 — Pool.Audit for the stale-lock reaper (A1) (2026-07-03)
 
 Companion to felhom-agent v0.62.0 (audit A1: pool-membership ownership check). `PVE_PRIVS_GUEST`