immich's first start: cause measured, fixed in the catalog (R-732 closed); ISO clean-tree gate (R-730 closed)

- R-732: the first-start geodata import runs up to 9 concurrent 5000-row INSERTs; the database needs
  ~400 MB anon + ~170 MB touched shared_buffers (the image's FIXED 512MB, not host-RAM sizing). 512M fits
  only with swap (bench swap 0: 61-104 kills; 9202 swap 512 MiB: survived by swapping). Controls: swap
  alone, limit alone flip it; shared_buffers 128MB alone does not. Catalog 56c4888: v3.2.4 + 768M,
  proven with swap off on both venues. audits/immich-first-start-2026-09-30/A-cause.md.
- R-730: scripts/iso/build-felhom-iso.sh refuses an uncommitted/untracked/unpushed tree (no bypass),
  records repo-commit from the gate and iso-v<version>; test iso/test/clean-tree.sh, red-proof run
  (status check removed -> 2 of 4 cases fail -> restored).
- R-731 narrowed (gitea 28.0.0 GA; mariadb 13.0 a short-term Rolling line). R-676 note.
- New rows R-733 (bench has no swap, boxes 512 MiB), R-734 (immich .immich markers -> files_may_change).
- STATUS: the golden line corrected (no bake is due; 0.283.1 is the newest release). Register 364 -> 366.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/CHANGELOG.md

@@ -1,3 +1,14 @@
+## ISO build refuses a dirty or unpushed tree (2026-09-30, R-730)
+
+- `iso/build-felhom-iso.sh`: a clean-tree gate right after argument parsing — any uncommitted or untracked change, or
+  `HEAD` ≠ `origin/main`, refuses the build before anything is made (no bypass flag). Why: ISO 1.29.0's manifest names
+  `8d539f9`, but the published image carries a fix committed 35 minutes after the build, so no commit is that image.
+- The manifest's `repo-commit` comes from the gate; `iso-version-tag` now reads `iso-v<version>` (the ISO's own line —
+  `installer-v*` is the host-install script's).
+- New test `iso/test/clean-tree.sh` (4 cases, a throwaway repo through the `FELHOM_ISO_REPO` seam); red-proof run (the
+  status check deleted → 2 cases fail). `iso/test/rootpw-emission.sh` builds from a throwaway clean repo too.
+- No image built or published; `SCRIPT_VERSION` and `ISO_VERSION` unchanged; 1.29.0 stays untagged.
+
 ## ISO 1.29.0 source — the box's own screen speaks English too (2026-09-18, R-559)
 
 **Source only. The image is NOT built or published by this commit** — see the release note at the end.