feat(iso): R-21 slice A — bare-metal Felhom ISO pipeline + first-boot bootstrap

scripts/iso/: a DooPlex pipeline (build-felhom-iso.sh + Dockerfile.assistant) that
turns the official PVE ISO into a Felhom auto-install ISO whose first-boot stub
installs a retry-forever felhom-bootstrap unit which unattended-fetches
felhom-host-install.sh from the public felhom.eu/scripts channel and runs it until the
host is enrolled + a guest provisioned. host-install is UNMODIFIED (invoked only).

- build gates the answer on validate-answer OUTPUT text, never $? (spike S1 exit-0 trap)
- stub is from-iso, fully-up, exactly-once; retry unit owns all network work (S8a)
- retry-vs-resume encoded once: plain first, --resume when install state exists (v1.11.3)
- secret-bearing (embeds the retrieval passphrase): supervised/single-use; env shredded on success

Validated on VM 310: build gate + red-proof, disk-filter fail-safe, chain + retry,
resume-decision, exactly-once, no-net retry+recovery. Terminal host-install rc-0 success
operator-gated (drill customer needs the password-gated create-UI). scripts v1.16.0;
ROADMAP R-21 -> in-progress. Detail in REPORT.md.

scripts/iso/felhom-bootstrap.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=Felhom host bootstrap (fetch + run felhom-host-install.sh unattended, retry until success)
+Documentation=https://felhom.eu/documentation/backlog/ROADMAP.md
+# Network-dependent work lives HERE (not in the first-boot stub) per spike S8a: the stub is
+# exactly-once and network-independent; this unit retries forever until host-install exits 0.
+After=network-online.target pve-cluster.service pveproxy.service
+Wants=network-online.target
+# Second exactly-once lock (the script also writes/checks this flag): once host-install succeeds,
+# the flag exists and this unit becomes a no-op even if re-enabled.
+ConditionPathExists=!/etc/felhom/.bootstrap-done
+# Retry forever: no start-rate limit.
+StartLimitIntervalSec=0
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/felhom-bootstrap.sh
+# Retry every 30s on any non-zero exit (fetch failed, host-install failed mid-run, no network yet).
+Restart=on-failure
+RestartSec=30
+# Journal-only logging (no secret ever printed; keys-not-values).
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target