host-install v1.16.0 (FELHOM_ESCROW via canonical sudoers fetch; hub hostInstallVersion synced, no deploy) + RUNBOOK-escrow-ceremony rewrite: controller wizard PRIMARY, CLI operator fallback, F1 threat-model paragraph (R over CF tunnel accepted 2026-07-13), stale-blob/supersede/void semantics

scripts/felhom-host-install.sh

@@ -182,9 +182,13 @@
 
 set -euo pipefail
 
-SCRIPT_VERSION="1.15.0"   # the SINGLE version source (F-1): -h, the run banners, and the hub
+SCRIPT_VERSION="1.16.0"   # the SINGLE version source (F-1): -h, the run banners, and the hub
                           # Setup-tab copy (hub internal/web/configs.go hostInstallVersion —
                           # scripts/hostinstall_gates.py asserts the two stay equal) all follow it.
+                          # 1.16.0: the FELHOM_ESCROW sudoers alias (controller-driven escrow
+                          # ceremony, agent v0.88.0) ships on every install/update — it rides the
+                          # CANONICAL sudoers fetch below (configs/felhom-agent.sudoers from the
+                          # agent repo, visudo-gated), no separate installer step.
 
 # Operator signing keys pinned at day-0 (GL-4; doc 04 §3 two-key model). EMPTY by default — the pin
 # CEREMONY is an operator step: generate the real keypairs OFFLINE, then fill these four constants