feat(iso): R-21 slice A — bare-metal Felhom ISO pipeline + first-boot bootstrap

scripts/iso/: a DooPlex pipeline (build-felhom-iso.sh + Dockerfile.assistant) that
turns the official PVE ISO into a Felhom auto-install ISO whose first-boot stub
installs a retry-forever felhom-bootstrap unit which unattended-fetches
felhom-host-install.sh from the public felhom.eu/scripts channel and runs it until the
host is enrolled + a guest provisioned. host-install is UNMODIFIED (invoked only).

- build gates the answer on validate-answer OUTPUT text, never $? (spike S1 exit-0 trap)
- stub is from-iso, fully-up, exactly-once; retry unit owns all network work (S8a)
- retry-vs-resume encoded once: plain first, --resume when install state exists (v1.11.3)
- secret-bearing (embeds the retrieval passphrase): supervised/single-use; env shredded on success

Validated on VM 310: build gate + red-proof, disk-filter fail-safe, chain + retry,
resume-decision, exactly-once, no-net retry+recovery. Terminal host-install rc-0 success
operator-gated (drill customer needs the password-gated create-UI). scripts v1.16.0;
ROADMAP R-21 -> in-progress. Detail in REPORT.md.

scripts/iso/Dockerfile.assistant

@@ -0,0 +1,24 @@
+# scripts/iso/Dockerfile.assistant — the build host for the Felhom bare-metal ISO pipeline (R-21).
+#
+# Debian trixie == PVE 9.x codename; the proxmox-auto-install-assistant is pinned to the ISO
+# generation by installing it from the PVE no-subscription repo of the ISO's Debian codename
+# (spike SPIKE-baremetal-iso-2026-07-16.md §15.6: pair by major.minor). Rebuild this image when the
+# target PVE generation changes (e.g. PVE 10 -> Debian forky) and record both versions in the build
+# manifest.
+#
+# Build:  docker build -f scripts/iso/Dockerfile.assistant -t felhom-iso-assistant:trixie scripts/iso
+FROM debian:trixie
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates wget gnupg xorriso shellcheck \
+    && rm -rf /var/lib/apt/lists/*
+
+# PVE 9.x (trixie) no-subscription repo — pairs the assistant to the 9.2 ISO generation.
+RUN wget -q https://enterprise.proxmox.com/debian/proxmox-release-trixie.gpg \
+        -O /etc/apt/trusted.gpg.d/proxmox-release-trixie.gpg
+RUN echo "deb http://download.proxmox.com/debian/pve trixie pve-no-subscription" \
+        > /etc/apt/sources.list.d/pve.list
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        proxmox-auto-install-assistant \
+    && rm -rf /var/lib/apt/lists/*