feat(iso): R-21 slice A — bare-metal Felhom ISO pipeline + first-boot bootstrap

scripts/iso/: a DooPlex pipeline (build-felhom-iso.sh + Dockerfile.assistant) that
turns the official PVE ISO into a Felhom auto-install ISO whose first-boot stub
installs a retry-forever felhom-bootstrap unit which unattended-fetches
felhom-host-install.sh from the public felhom.eu/scripts channel and runs it until the
host is enrolled + a guest provisioned. host-install is UNMODIFIED (invoked only).

- build gates the answer on validate-answer OUTPUT text, never $? (spike S1 exit-0 trap)
- stub is from-iso, fully-up, exactly-once; retry unit owns all network work (S8a)
- retry-vs-resume encoded once: plain first, --resume when install state exists (v1.11.3)
- secret-bearing (embeds the retrieval passphrase): supervised/single-use; env shredded on success

Validated on VM 310: build gate + red-proof, disk-filter fail-safe, chain + retry,
resume-decision, exactly-once, no-net retry+recovery. Terminal host-install rc-0 success
operator-gated (drill customer needs the password-gated create-UI). scripts v1.16.0;
ROADMAP R-21 -> in-progress. Detail in REPORT.md.

scripts/iso/answer.toml.tmpl

@@ -0,0 +1,34 @@
+# scripts/iso/answer.toml.tmpl — Proxmox auto-install answer template for the Felhom ISO pipeline.
+#
+# build-felhom-iso.sh renders this into a concrete answer.toml by substituting:
+#   __FQDN__       <- profile's FELHOM_FQDN
+#   __ROOT_HASH__  <- a FRESH THROWAWAY crypt hash minted per build (never a real credential)
+#   __DISK_SETUP__ <- profile's FELHOM_DISK_SETUP block (disk-list OR a udev filter)
+# The rendered answer is then run through validate-answer with the OUTPUT-PARSE gate (validate-answer
+# returns exit 0 even on failure — spike S1 trap; the build parses the message text, never $?).
+#
+# This committed template carries ONLY the __ROOT_HASH__ placeholder, never a real hash.
+
+[global]
+keyboard = "en-us"
+country = "hu"
+fqdn = "__FQDN__"
+mailto = "noreply@felhom.eu"
+timezone = "Europe/Budapest"
+# THROWAWAY-PLACEHOLDER — build-felhom-iso.sh mints a fresh per-build crypt hash here.
+root-password-hashed = "__ROOT_HASH__"
+# Optional emergency/validation root SSH key (profile FELHOM_ROOT_SSH_KEY); blank -> line removed.
+__ROOT_SSH_KEYS__
+
+[network]
+source = "from-dhcp"
+
+# Enable the baked first-boot stub (prepare-iso --on-first-boot). from-iso = no network / no
+# cert-rotation risk (R-21 ruling); fully-up = the stub runs after pveproxy so pvesh/pct work and
+# the retry unit it installs can drive host-install (spike S3/S8a).
+[first-boot]
+source = "from-iso"
+ordering = "fully-up"
+
+# --- disk selection (from the build profile) ---
+__DISK_SETUP__