docs: scripts v1.22.0 + website grid CHANGELOGs, ROADMAP R-38 shipped, R-45/R-46, REPORT

R-38 flips to SHIPPED with the live-canary evidence. Two new items registered
from tonight's work: R-45 (unified async-job feedback — five one-off progress
surfaces now exist and agree on nothing; the two lessons any framework must
encode are "probe the terminal state, never infer it" and "a source reporting
nothing is normal, not broken") and R-46 (verification copies are now visible
but still cannot be browsed and never expire — the invisible-result gap and the
disk-lifecycle gap, designed together because they are the same object).

Pre-invite checklist gains the golden note: build-golden v2.1.0 makes goldens
>= 0.147.x carry all four infra images; no rebuild for this alone.

REPORT-<topic>.md per the parallel-session rule — another session is writing in
this clone tonight, so the shared REPORT.md is left alone.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE

scripts/CHANGELOG.md

@@ -1,5 +1,62 @@
 # Felhom scripts — Changelog
 
+## build-felhom-iso.sh v1.22.0 — the boot screen is ours, and it offers exactly one thing (R-38) (2026-07-19)
+
+**A boot menu is a product surface, and ours was Proxmox's.** Every ISO is now repacked after
+`prepare-iso` to carry a Felhom boot screen and — the half that actually matters — a menu with
+**exactly one entry**.
+
+- **The safety half.** The stock PVE menu offers *Install Proxmox VE (Graphical)*, *(Terminal UI)*, a
+  serial variant, and an **Advanced Options** submenu holding two `nomodeset` entries, three debug
+  entries, *Rescue Boot*, memtest and *UEFI Firmware Settings*. Every one of those reaches the
+  **manual** installer, whose first question is which disk to wipe. A customer — or their helpful
+  nephew — must not be able to get there from a boot menu they are staring at. Those entries are not
+  hidden and not password-gated: **they are not emitted**. What ships is „Felhom telepítés", default,
+  5 s.
+- **Boot behavior is unchanged.** The `linux`/`initrd` lines are lifted **verbatim at repack time**
+  from the ISO's own *Install Proxmox VE (Automated)* entry rather than frozen into a copy in this
+  repo, so a PVE bump that moves the kernel path or edits the append line tracks automatically
+  instead of silently diverging. The build **fails** if they cannot be found, if the append line has
+  lost `proxmox-start-auto-installer`, or if `auto-installer-mode.toml` is absent — that last one
+  because without it the single Felhom-labelled entry would boot a *manual* installer, which is the
+  precise outcome this change exists to prevent.
+- **Gates, and then a re-check against the shipped artifact.** The rendered menu is asserted to have
+  exactly 1 `menuentry`, 0 `submenu`s and no live reference to
+  `proxtui`/`proxdebug`/`nomodeset`/`Rescue Boot`/`memtest`/`fwsetup` (comments are stripped first —
+  the template's header names the dropped entries on purpose). Then the menu and the theme background
+  are read back **out of `final.iso`**, not out of the extract tree, so "the branding landed in the
+  image we ship" is proven rather than assumed.
+- **The boot card.** `grub/generate-grub-background.sh` letterboxes `website/assets/og-image_2.png`
+  onto a 1024×768 gfxterm canvas at repack time (ImageMagick, added to the assistant image), so the
+  boot screen has **one source** — the website asset — and not a second pre-rendered PNG in the repo
+  to drift. The card's own subtle background grid is continued across the letterbox fill
+  **phase-locked** to where the card's grid lands, so the fill is seamless instead of a 500 px square
+  of grid floating in flat navy. The generator refuses a source whose geometry no longer matches the
+  measured grid constants — a silently swapped asset would misplace every line, and that only shows
+  up on a boot screen nobody re-checks.
+- **Menu positioning needs a theme.** Plain `background_image` cannot move the menu off the wordmark,
+  so `grub/felhom-theme.txt` (gfxmenu) puts it in the lower third the layout deliberately leaves
+  empty, with the entry optically centered under the card (measured off a canary screenshot — the
+  comment records the measurement). No "e: edit entry" hint label: advertising the editor works
+  against a single-entry menu.
+- **`mkimage-surgery.sh` → `iso-repack.sh`.** Branding and the slice-B loader swap need the same
+  extract → modify → re-master cycle, so they now share **one** pass instead of re-mastering twice.
+  The mkimage recipe is untouched. The embedded module list is still derived from the **stock**
+  `grub.cfg` (snapshotted before branding rewrites it, so branding cannot shrink the embedded set),
+  plus gfxmenu's `bitmap`/`bitmap_scale`/`trig` renderer dependencies.
+- `--no-brand` exists for debugging the stock menu and says so loudly in the build log and the
+  manifest. It is not a shipping mode.
+
+**Live-validated (nested canary, UEFI/OVMF, PVE 9.2-1).** GRUB renders the card; the single entry is
+selected and counts down in Hungarian (accents render correctly under gfxterm); it auto-fires at 0;
+the automatic installer runs and reaches the **match-nothing abort exactly as in v1.21.0**
+(`ERROR: Installation failed: filter did not match any device` → `Installation aborted`), touching no
+disk. Both shipping ISOs rebuilt (see `REPORT-iso-branding-2026-07-19.md` for shas).
+
+**Not touched (deferred):** the installer squashfs/initrd theme — the post-GRUB screens are still
+Proxmox-branded. GRUB's `e`/`c` keys also remain reachable (suppressing them needs a superuser
+password, which is a separate decision); the menu no longer advertises them.
+
 ## build-felhom-iso.sh v1.21.0 — the pairing wait stops looking like a failure (R-33) (2026-07-18)
 
 **Waiting is not failing, and must not be reported as failure.** Until now the PAIRING poll loop WAS