feat(iso): R-21 slice A — bare-metal Felhom ISO pipeline + first-boot bootstrap

scripts/iso/: a DooPlex pipeline (build-felhom-iso.sh + Dockerfile.assistant) that
turns the official PVE ISO into a Felhom auto-install ISO whose first-boot stub
installs a retry-forever felhom-bootstrap unit which unattended-fetches
felhom-host-install.sh from the public felhom.eu/scripts channel and runs it until the
host is enrolled + a guest provisioned. host-install is UNMODIFIED (invoked only).

- build gates the answer on validate-answer OUTPUT text, never $? (spike S1 exit-0 trap)
- stub is from-iso, fully-up, exactly-once; retry unit owns all network work (S8a)
- retry-vs-resume encoded once: plain first, --resume when install state exists (v1.11.3)
- secret-bearing (embeds the retrieval passphrase): supervised/single-use; env shredded on success

Validated on VM 310: build gate + red-proof, disk-filter fail-safe, chain + retry,
resume-decision, exactly-once, no-net retry+recovery. Terminal host-install rc-0 success
operator-gated (drill customer needs the password-gated create-UI). scripts v1.16.0;
ROADMAP R-21 -> in-progress. Detail in REPORT.md.

scripts/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Felhom scripts — Changelog
 
+## felhom bare-metal ISO pipeline v1.16.0 — NEW (R-21 slice A, 2026-07-16)
+
+New operator tooling under `scripts/iso/`: a reproducible DooPlex pipeline that turns the official
+PVE ISO into a Felhom auto-install ISO whose first-boot chain unattended-fetches-and-runs
+`felhom-host-install.sh` until the host is enrolled + a guest provisioned. `felhom-host-install.sh`
+is **unchanged** (invoked, not modified). Tagged **v1.16.0** to align the ISO with the current
+host-install release (they must stay coherent; the ISO's baked invocation targets that flag surface).
+
+- `Dockerfile.assistant` (assistant paired to the ISO's PVE generation by Debian codename + shellcheck),
+  `build-felhom-iso.sh` (render answer from `answer.toml.tmpl` + a profile, mint a fresh THROWAWAY root
+  hash per build, **gate validate-answer on OUTPUT TEXT not `$?`** — spike S1 exit-0-on-failure trap,
+  `prepare-iso --fetch-from iso --on-first-boot`, emit ISO + sha256 + manifest).
+- In-ISO chain: `stub-first-boot.sh` (dumb, exactly-once, from-iso/fully-up) installs
+  `felhom-bootstrap.sh` + `felhom-bootstrap.service` (retry-forever `Type=oneshot`+`Restart=on-failure`)
+  + a 0600 `bootstrap.env`. Retry-vs-resume encoded once (plain first; `--resume` when
+  `/var/lib/felhom-install/state.json` exists — safe per host-install v1.11.3).
+- **Secret-bearing:** the unattended install needs the customer retrieval passphrase, so the ISO embeds
+  it (the distribution URL itself carries no secret). Supervised/single-use; the bootstrap scrubs the
+  env on success. Slice C removes the secret from the *distributed* ISO via claim-pairing.
+- Validated on nested VM 310: build gate + red-proof; disk-filter fail-safe through the pipeline;
+  stub→unit→real public-channel fetch→invocation→retry; resume decision; exactly-once; no-net retry +
+  recovery. Terminal host-install success (hub-enrolled + guest-provisioned) is operator-gated (drill
+  customer needs the password-gated create-UI; live-DB insert unsafe). Full report: root `REPORT.md`,
+  `documentation/audits/SPIKE-baremetal-iso-2026-07-16.md`.
+
 ## felhom-host-install v1.16.0 — FELHOM_ESCROW rides the canonical sudoers (2026-07-13)
 
 Companion to agent v0.88.0 + controller v0.127.0 (the controller-driven escrow ceremony wizard).