hub v0.16.0 + host-install v1.1.0: Day-0 artifact manifest + self-install the agent (BUNDLE slice)

Hub (v0.16.0):
- store: ArtifactManifest{agent,golden version+sha256} in hub_settings; Get/SetArtifactManifest.
- handler: GET /api/v1/artifacts/{id} (passphrase auth, mirrors config-retrieve). Unset => 200 empty.
- web: operator UI "Day-0 artifacts" card (POST /configs/artifacts), semver + 64-hex validation.
- artifact_test.go: returned-verbatim / unset-empty / 401 / 404 / store round-trip.

host-install (v1.1.0):
- new step 5/8 agent-install: manifest + git token (config-retrieve) -> fetch binary from Gitea ->
  verify sha256 vs hub manifest (abort on mismatch) -> install non-root felhom-agent user + binary +
  sudoers (visudo -cf) + canonical unit. Idempotent.
- new step 7/8 golden: local fallback else fetch+verify+import from Gitea (--force-gitea-golden).
- agent now runs non-root (privileged.mode sudo), config chowned to the service user.
- README prerequisites trimmed to: install PVE + create customer.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install.sh v1.1.0 — self-install the agent + fetch the golden from Gitea (2026-06-28)
+
+The script now **installs the agent itself** (the last big manual Day-0 prerequisite is gone). It
+fetches the agent binary + golden from Gitea generic packages and **verifies each against the
+hub-vouched artifact manifest** before installing/using it. BUNDLE slice; pairs with hub v0.16.0
+(artifact manifest endpoint + operator UI) and felhom-agent v0.43.0 (canonical unit + publish).
+
+- **New step `5/8 agent install`** (before agent-config): resolves the manifest
+  (`GET /api/v1/artifacts/{id}`, passphrase) + the git fetch token (from the customer's
+  `controller.yaml` via config-retrieve — **NO new credential**); fetches
+  `/api/packages/admin/generic/felhom-agent/<ver>/felhom-agent`, **verifies sha256 vs the hub
+  manifest** (aborts on mismatch — verify-before-use), backs up any existing binary, installs
+  `0755 /usr/local/bin/felhom-agent`; ensures the non-root `felhom-agent` system user; installs the
+  canonical sudoers (`0440`, `visudo -cf`-validated) + systemd unit; `daemon-reload` + enable. Idempotent:
+  same version already installed + service active → skip.
+- **New step `7/8 golden`:** local auto-discovery stays the default/fallback; otherwise fetches
+  `/api/packages/admin/generic/felhom-golden/<ver>/golden.tar.zst`, **verifies sha256**, and imports it
+  into the archive storage's dump dir for the restore. `--force-gitea-golden` forces the Gitea path.
+- **Non-root agent model:** the agent now runs as `felhom-agent` with `privileged.mode: "sudo"` (was the
+  dev/CI `direct`+root shortcut). The config is `chown`ed to the service user (0600) so the daemon can
+  read it; `systemctl is-active` after restart is the real proof the non-root user can read the config.
+- **Pre-flight relaxed:** a missing agent binary is no longer fatal (step 5 installs it); the local
+  golden requirement is deferred to step 7.
+- **Trust model:** checksum **trust root = the hub** (manifest), not Gitea; the fetch credential is the
+  existing config-retrieve git token; artifacts are pinned to a version (never `:latest`).
+- **Secrets:** the git token is a never-logged runtime carrier (cleared on EXIT alongside the passphrase
+  / pve-token / hub api_key); the sudoers is `0440` and `visudo -cf`-validated before install.
+- `bash -n` + `shellcheck` clean.
+
 ## felhom-host-install.sh v1.0.0 — Day-0 host bootstrap (provision mode) (2026-06-26)
 
 First release. A single operator-run script that automates Day-0 on a freshly-PVE-installed