host-install v1.13.0: systemd-journal group for the agent user + NAS feature doc

The NAS verify pipeline (agent v0.81.0) reads mount-unit journals unprivileged
— group membership, NO sudoers grant. Fixes the v1.11.0/1.12.0 header drift.
New authoritative feature doc documentation/controller/network-storage-nas.md
(verify pipeline, §8 truth table, Q4 error taxonomy, retry=0, Route A recipes
incl. the chmod-persists nuance).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

scripts/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install v1.13.0 — systemd-journal group for the agent user (NAS verify) (2026-07-11)
+
+- The agent-user setup now adds `felhom-agent` to the **`systemd-journal` group** (idempotent
+  `usermod -aG`): the NAS verify-before-commit pipeline (agent v0.81.0) classifies mount failures
+  from an UNPRIVILEGED `journalctl -u <unit>` read — group membership instead of a sudoers grant
+  (rule: no journalctl via sudo). Existing installs get the one-liner
+  `usermod -aG systemd-journal felhom-agent && systemctl restart felhom-agent` (applied to the
+  demo host during this task's live validation; Peti's box only when the NAS feature reaches him).
+- Version-header drift fixed: the file header still said v1.11.0 while `SCRIPT_VERSION` was
+  1.12.0 (the v1.12.0 bump shipped without a changelog entry or header sync); both now 1.13.0.
+
 ## felhom-host-install v1.11.0 — uninstaller gap-closure + operator-key day-0 fold (TASK GL-4, go-live G6 + G1-follow-up) (2026-07-08)
 
 - **Uninstall gap-closure (G6):**