iso 1.27.1: the FIRST boot is Felhom's — postinst masks pvebanner and writes /etc/issue

The 1.27.0 proof install (VM 331, screen s20) still showed Proxmox's
":8006" block on the first boot: pvebanner.service ran before
felhom-bootstrap could mask it, and the Felhom text lost its o/u double
acutes (painted before the Latin-2 font loads).
- postinst: mask pvebanner by symlink (a file act, valid in the chroot) and
  write /etc/issue; both guarded, still exit 0 (G8 self-checks unchanged).
- bootstrap: same text, byte-identical, no o/u double acutes (second line).
- harness: PI scenario (postinst in a container) + no-accent checks, red
  first against the 1.27.0 code; 55/55 green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/iso/test/bootstrap-modes.sh

@@ -188,6 +188,9 @@ check "R-496: /etc/issue is the Felhom text"          "grep -q 'Felhom otthoni s
 check "R-496: /etc/issue carries no admin URL (:8006)" "! grep -q '8006' /work/issue"
 check "R-496: /etc/issue does not say Proxmox"         "! grep -qi 'proxmox' /work/issue"
 check "R-496: pvebanner.service masked"                "grep -q 'mask pvebanner.service' /work/systemctl.log"
+# v1.27.1: the login screen is painted BEFORE the Latin-2 console font loads, so ő/ű in /etc/issue
+# rendered as dropped letters on the 1.27.0 proof install („képernyon", „teendod", screen 331-s20).
+check "R-496: /etc/issue carries no ő/ű (the boot font lacks them)" "! grep -q '[őűŐŰ]' /work/issue"
 
 # ============ P: pairing loop (v1.21.0) — register, wait unbound INSIDE one invocation, deliver =====
 say "P: pairing env -> register + in-script 204 wait -> 200 delivery -> host-install, ONE invocation"
@@ -282,6 +285,21 @@ check "interfaces untouched"                     "[ \"$PRE_SHA\" = \"$POST_SHA\"
 check "console screen still painted"             "grep -q 'Nincs hálózati kapcsolat' /work/console.out"
 check "no-sweep branch logged"                   "grep -q 'no sweep, interfaces untouched' /work/run.log"
 
+# ============ PI: the package postinst (v1.27.1) — the FIRST boot must already be Felhom's ===========
+# Measured on the 1.27.0 proof install (screen 331-s20): pvebanner.service ran at the first boot BEFORE
+# felhom-bootstrap could mask it, so the household's first screen still carried the Proxmox admin URL.
+# The postinst runs in the installer chroot (no systemd): it may only write files. It masks by symlink.
+say "PI: postinst configure -> pvebanner masked by symlink, /etc/issue is Felhom's, exit 0"
+rm -f /etc/systemd/system/pvebanner.service /etc/issue /work/systemctl.log
+printf '\nWelcome to the Proxmox Virtual Environment ... https://10.0.0.1:8006/\n' > /etc/issue
+sh /work/postinst configure; rc=$?
+check "PI: postinst exits 0"                               "[ $rc -eq 0 ]"
+check "PI: pvebanner.service -> /dev/null (masked by file)" "[ \"\$(readlink /etc/systemd/system/pvebanner.service)\" = /dev/null ]"
+check "PI: /etc/issue is the Felhom text"                   "grep -q 'Felhom otthoni szerver' /etc/issue"
+check "PI: /etc/issue carries no admin URL"                 "! grep -q '8006' /etc/issue"
+check "PI: /etc/issue carries no ő/ű"                       "! grep -q '[őűŐŰ]' /etc/issue"
+check "PI: postinst and bootstrap write the SAME issue text" "cmp -s /etc/issue /work/issue"
+
 echo "=================================================="
 if [ $fail -eq 0 ]; then echo "ALL BOOTSTRAP-MODE TESTS PASSED"; else echo "SOME TESTS FAILED"; fi
 exit $fail