host-install v1.16.0 (FELHOM_ESCROW via canonical sudoers fetch; hub hostInstallVersion synced, no deploy) + RUNBOOK-escrow-ceremony rewrite: controller wizard PRIMARY, CLI operator fallback, F1 threat-model paragraph (R over CF tunnel accepted 2026-07-13), stale-blob/supersede/void semantics

scripts/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install v1.16.0 — FELHOM_ESCROW rides the canonical sudoers (2026-07-13)
+
+Companion to agent v0.88.0 + controller v0.127.0 (the controller-driven escrow ceremony wizard).
+No new installer STEP: the `FELHOM_ESCROW` sudoers alias (the wizard's fixed-argv sudo
+self-invocation grant) ships via the existing canonical-sudoers fetch
+(`configs/felhom-agent.sudoers` from the agent repo, `visudo -cf`-gated before install) — the
+bump documents that every ≥1.16.0 install/update carries it. Hub `hostInstallVersion` bumped in
+the same commit (hostinstall_gates.py asserts equality); the hub deploy rides the next hub train
+(display-only lag, accepted). EXISTING hosts get the refreshed sudoers with the agent-0.88.0
+deploy (ship-configs step), not from this script.
+
 ## manifest_bearer_gate.py — new gate: no bearer-shaped literals in manifests/ (2026-07-13)
 
 Part of the hub v0.53.0 bearer de-git. Greps every `manifests/*.yaml` for 64-hex literals