ops: fleet floor raised to 0.255.0 — and it delivered on its own

POST /configuration/global-floor with min_controller_version=0.255.0 and the
declared min_agent=0.131.0 (R-472); 303 flash=floor_set, read back from the
form, not from the POST.

The proof is the N100: it was never hand-deployed and its own Docker reports
felhom-controller:0.255.0 healthy within five minutes of the save. Three boxes
remain below — all BLOCKED or DOWN, which is a floor being held, not a floor
failing; each takes it on its next check-in.

R-580 filed: curl's %{redirect_url} rebuilds the request URL WITH the --netrc
credentials in it, so the hub password was printed into the session's own
output. Nothing written to a file, nothing committed. The build-deploy skill
now carries the rule.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -26,11 +26,18 @@ browser on this machine. That part is your click.
 
 **Rows.** One opened and closed the same day.
 
-**Needs you — one decision.** **Raise the floor to 0.255.0?**
-- **If you do:** every box serves the fixed pages on its next check-in, and nobody sees the broken globe.
-- **If you do nothing:** boxes on 0.254.0 keep showing it to anyone whose browser cached the old style
-  file. Nothing is at risk; it just looks wrong.
-- I would raise it — the thing it fixes is the thing you noticed.
+**The floor is raised — nothing needs you.** You asked for it, so I did it: every box now must run
+0.255.0 or newer. **It delivered on its own:** the N100 was never touched by hand and picked up the
+new version in under five minutes. The HP box was already on it.
+
+Three machines are still on older versions. All three are switched off or blocked, and a box that is
+not running cannot be told anything. Each takes the new version the moment it comes back. That is the
+floor working, not failing.
+
+**One new row, mine, nothing for you to do.** While pressing the button I used a command option that
+printed your hub password back into my own session log. It went nowhere else — no file, nothing
+saved, nothing sent. I wrote down how to avoid it next time. **If you want to be thorough, change
+that password**; nothing suggests you need to.
 
 ---