R-300: uninstall no longer leaves dnsmasq blocking the next install

Removing the snippet and restarting left dnsmasq enabled and unconstrained on
0.0.0.0:53, so the next byo install's preflight refused and the customer went
debugging a home network that was never at fault.

Ownership is recorded at preflight (the only moment it is a fact - the package
is installed by the agent, not this script) and honoured at removal. Boxes
already in the field carry no record and fail safe to restart-only, with the
reason and the command logged; the preflight message covers them instead.

Not observed live - no installer-v1.27.0 tag is cut. Files R-299..R-301.

scripts/CHANGELOG.md

@@ -1,3 +1,41 @@
+## felhom-host-install.sh v1.27.0 — our removal no longer blocks our reinstall (2026-08-12, R-300)
+
+**Felhom's own uninstall left the thing that makes Felhom's own next install refuse.** `--uninstall`
+removed the `/etc/dnsmasq.d/felhom-*.conf` snippet and **restarted** the daemon, leaving the package
+installed and the unit enabled. Unconstrained, dnsmasq binds `0.0.0.0:53`, and the next install's byo
+preflight hard-refuses with *"a resolver is already bound to :53"*. **The customer reads a message
+that looks like it is about their home network, which was never at fault.** Measured on `demo-hp`
+2026-08-09; the counterfactual (stop + disable, nothing else changed) made the preflight pass.
+
+**Ownership is recorded, never inferred.** The package is installed **by the AGENT**
+(`felhom-agent/internal/lanresolver/lanresolver.go:107`, `apt-get install -y -q dnsmasq`), not by this
+script, and conditionally — so at uninstall time "did Felhom install it?" cannot be reconstructed from
+anything on the box. **Preflight now records `dnsmasq_preexisting` before anything is installed**,
+which is the only moment it is a fact. Deliberately NOT a package-file mtime: that is a heuristic
+dressed as a fact, and this project has been bitten by exactly that shape.
+
+**Three cases at removal, and the third is the one that matters for the field:**
+
+| record | action |
+|---|---|
+| `no` — Felhom installed it | **stop + disable**, so our leftover cannot block our reinstall |
+| `yes` — it pre-dated us | restart only (today's behaviour). We never stop a resolver we did not install |
+| *absent* — **every box already in the field** | **restart only, exactly as before**, and say so out loud |
+
+**What the record does for machines already in the field: nothing, deliberately.** They carry no
+record, so removal fails safe to the owner's case and leaves dnsmasq running, logging the reason and
+the exact command. Silently disabling a resolver on a host we cannot prove we own is the one outcome
+worse than the wall this fixes. Those boxes are covered by the preflight message instead.
+
+**The preflight refusal keeps everything it had** — the finding, the two routes, and the explicit
+promise not to touch DNS on a host Felhom does not own — and gains the one thing it lacked: **when the
+bound resolver is dnsmasq, it says it looks like ours and gives the command** (`systemctl disable --now
+dnsmasq`), while still saying to leave it alone if it is the household's.
+
+**NOT OBSERVED LIVE, and therefore NOT PUBLISHED.** The required install → uninstall → install cycle on
+`drill-r50` was not run this session, so — like R-297 — this rides in `main`, which publishes nothing
+(R-110). **No `installer-v1.27.0` tag is cut.** Both installer fixes now await one drill session.
+
 ## felhom-host-install.sh v1.26.0 — an install takes the golden you approved (2026-08-10, R-297)
 
 **Step 7 short-circuited on ANY local golden archive: no version compare, no digest, no warning.**