scripts v1.18.0 — R-21 slice B: firmware loader option --loader shim|mkimage (F1)

Closes N100 F1 (HIGH): cheap AMI (AN3PLUS 0.01-class) UEFI firmware can't
relocate the ISO's stock signed GRUB from USB (relocation 0x0). The run's live
grub-mkimage workaround is now a first-class pipeline mode.

- build-felhom-iso.sh: --loader shim|mkimage (default shim, byte-for-byte
  unchanged; profile-settable FELHOM_LOADER; --loader wins). Loud banner +
  manifest loader:/grub-mkimage: fields + -mkimage filename suffix.
- mkimage-surgery.sh (new): post-prepare-iso, in the assistant container. Builds
  a monolithic grub-mkimage loader from the ISO's own GRUB (module set from its
  grub.cfg; embedded search --fs-uuid -> configfile the real menu). Swaps it into
  the ISO9660 tree (real lowercase path) + the efi.img ESP; xorriso re-master
  preserves BIOS-hybrid + UEFI + GPT-ESP, drops only Apple HFS+/APM. Recipe from
  the N100 run evidence, not re-derived.
- Dockerfile.assistant: grub-common + grub-efi-amd64-bin + mtools + dosfstools.
  profiles/n100.profile (new, mkimage + SB-off note).
- Validated on nested VM 311 (RUNBOOK-B legs): leg1 shim boots+installs under
  OVMF SB-enforcing + SeaBIOS; leg2 mkimage boots+installs under SB-off; leg3
  (red-proof) mkimage under SB-enforcing FAILS Access Denied (unsigned -> SB must
  be OFF); leg4 surgery byte-identical payload. bash -n + shellcheck clean.
  Physical N100 closure folds into the rehearsal (n100-safety match-nothing ISO
  built + sha-recorded, unbooted). PXE stays a deferred R-21 note.

scripts/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Felhom scripts — Changelog
 
+## build-felhom-iso.sh v1.18.0 — firmware loader option `--loader shim|mkimage` (R-21 slice B, F1) (2026-07-17)
+
+Closes N100 finding **F1 (HIGH):** cheap AMI (`AN3PLUS 0.01`-class) UEFI firmware can't relocate the
+ISO's stock signed GRUB from USB (`relocation 0x0 is not implemented yet`; SB-off + shim-bypass don't
+help). The run's live `grub-mkimage` workaround is now a first-class pipeline mode.
+
+- **`--loader shim|mkimage`** (default **shim**; profile-settable via `FELHOM_LOADER`, `--loader`
+  wins). `shim` = the stock output, **byte-for-byte unchanged** (the surgery is skipped) — keeps the
+  MS-signed shim→GRUB chain and Secure Boot on compliant firmware (S2b). `mkimage` replaces the ISO's
+  UEFI boot path with a **monolithic `grub-mkimage` loader** built from the ISO's own GRUB modules
+  (module set from the ISO's `grub.cfg`; embedded `search --fs-uuid` → `configfile` the real menu).
+  The recipe is reproduced from the N100 run evidence, not re-derived.
+- **`mkimage-surgery.sh`** (new): runs in the assistant container **after** `prepare-iso`, so the
+  answer/first-boot payload is provably untouched except the loader. Swaps the loader into the ISO9660
+  tree (real lowercase Rock-Ridge path) **and** inside the `efi.img` ESP (FAT), then re-masters with
+  `xorriso` preserving the hybrid BIOS boot (grub2-mbr + El Torito) and the GPT EFI System Partition,
+  dropping only the irrelevant Apple HFS+/APM map (which trips xorriso's overlap check on re-emit).
+- **Loud + unmistakable (rule 4):** build banner, manifest `loader:` + `grub-mkimage:` fields, and a
+  **`-mkimage`** filename suffix when non-default. mkimage ISOs are **unsigned → Secure Boot must be
+  OFF** on the target board.
+- **Dockerfile.assistant:** adds `grub-common` + `grub-efi-amd64-bin` + `mtools` + `dosfstools` (grub
+  2.12 == the PVE 9.x ISO's `2.12-9+pmx2` generation). **New `profiles/n100.profile`** (cheap-board,
+  `FELHOM_LOADER="mkimage"`, SB-off note).
+- **Validated (RUNBOOK-B legs, nested VM 311 on felhom-pve):** leg 1 shim boots + zero-touch installs
+  under OVMF **Secure Boot enforcing** (+ SeaBIOS boot — hybrid path survived); leg 2 `--loader
+  mkimage` boots + installs under OVMF **SB-off** (the monolith's embedded fs-uuid search found the
+  ISO + chained its menu); **leg 3 (red-proof)** the mkimage ISO under **SB-enforcing FAILS** —
+  firmware `Access Denied`, no boot; leg 4 the surgery is surgical (only the loader + regenerated El
+  Torito artifacts differ; the full install payload is byte-identical). `bash -n` + shellcheck clean.
+  Physical N100 closure folds into the supervised rehearsal (an `n100-safety` match-nothing ISO built
+  + sha-recorded, unbooted, for an optional zero-risk pre-flight).
+
 ## felhom-tenantsync.sh v1.1.0 — deprovision op (customer RESET teardown) (2026-07-17)
 
 Adds the `{"op":"deprovision","customer_id":"<id>"}` op the slice-1 header explicitly reserved