feat(iso): R-21 slice A — bare-metal Felhom ISO pipeline + first-boot bootstrap

scripts/iso/: a DooPlex pipeline (build-felhom-iso.sh + Dockerfile.assistant) that
turns the official PVE ISO into a Felhom auto-install ISO whose first-boot stub
installs a retry-forever felhom-bootstrap unit which unattended-fetches
felhom-host-install.sh from the public felhom.eu/scripts channel and runs it until the
host is enrolled + a guest provisioned. host-install is UNMODIFIED (invoked only).

- build gates the answer on validate-answer OUTPUT text, never $? (spike S1 exit-0 trap)
- stub is from-iso, fully-up, exactly-once; retry unit owns all network work (S8a)
- retry-vs-resume encoded once: plain first, --resume when install state exists (v1.11.3)
- secret-bearing (embeds the retrieval passphrase): supervised/single-use; env shredded on success

Validated on VM 310: build gate + red-proof, disk-filter fail-safe, chain + retry,
resume-decision, exactly-once, no-net retry+recovery. Terminal host-install rc-0 success
operator-gated (drill customer needs the password-gated create-UI). scripts v1.16.0;
ROADMAP R-21 -> in-progress. Detail in REPORT.md.

scripts/iso/stub-first-boot.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+#===============================================================================
+# stub-first-boot.sh — the ONE executable the Proxmox auto-installer runs on first boot
+# (--on-first-boot, [first-boot] source=from-iso, ordering=fully-up). This file is a SKELETON:
+# build-felhom-iso.sh fills the three base64 markers below (bootstrap script, unit, env) and passes
+# the RENDERED result to prepare-iso. The rendered stub is secret-bearing (the env carries the
+# retrieval passphrase); the committed skeleton is not.
+#
+# DUMB BY DESIGN: the first-boot hook is exactly-once regardless of success (spike S3 x S8a), so this
+# stub does NO network and NO fallible logic — it only lays down the retry unit + env and starts it.
+# Everything that can fail lives in felhom-bootstrap.service, which retries forever.
+#===============================================================================
+set -euo pipefail
+
+LOG=/var/log/felhom-first-boot.log
+exec >>"$LOG" 2>&1
+echo "=== felhom stub-first-boot $(date -Is) uid=$(id -u) ==="
+
+install -d -m 0755 /etc/felhom /usr/local/sbin
+
+# --- bootstrap script (no secret; world-readable ok) ----------------------------------------------
+base64 -d > /usr/local/sbin/felhom-bootstrap.sh <<'__B64_BOOTSTRAP_SH__'
+@@BOOTSTRAP_SH_B64@@
+__B64_BOOTSTRAP_SH__
+chmod 0755 /usr/local/sbin/felhom-bootstrap.sh
+
+# --- systemd retry unit ---------------------------------------------------------------------------
+base64 -d > /etc/systemd/system/felhom-bootstrap.service <<'__B64_BOOTSTRAP_UNIT__'
+@@BOOTSTRAP_UNIT_B64@@
+__B64_BOOTSTRAP_UNIT__
+chmod 0644 /etc/systemd/system/felhom-bootstrap.service
+
+# --- bootstrap env (SECRET-BEARING: retrieval passphrase) -> 0600 ---------------------------------
+umask 077
+base64 -d > /etc/felhom/bootstrap.env <<'__B64_BOOTSTRAP_ENV__'
+@@BOOTSTRAP_ENV_B64@@
+__B64_BOOTSTRAP_ENV__
+chmod 0600 /etc/felhom/bootstrap.env
+umask 022
+
+systemctl daemon-reload
+systemctl enable felhom-bootstrap.service
+systemctl start --no-block felhom-bootstrap.service
+
+echo "=== felhom stub-first-boot done — felhom-bootstrap enabled + started ==="
+exit 0