installer 1.25.0: the off-site tier stops asking to prune (R-191)

Every weekly off-site run uploaded successfully and then failed the job on a prune
the box's token is deliberately refused — R-89 moved off-site pruning server-side
to ep0 and box tokens stay write-only. The 2026-07-26 'two weeks' ruling was not
reversed; where it is enforced moved, and keep_last: 2 did not follow. Now 0,
which the agent's existing guard already reads as 'never prune from the box'.

Verified read-only on ep0 before changing it: both namespaces have a prune job at
03:30 keep-last 2 that has run every day since 2026-07-27 — 18 tasks, all OK, the
newest keeping exactly two. Without that check this would have traded a weekly
false alarm for unbounded growth.

A gate asserts the offsite tier carries no client-side prune. The local tier is
untouched.

scripts/CHANGELOG.md

@@ -1,3 +1,26 @@
+## 1.25.0 — the off-site tier stops asking to prune (2026-08-04, R-191)
+
+**A backup that worked must not report failure.** The off-site tier was written with `keep_last: 2`,
+so every weekly run uploaded its snapshot successfully and then failed the whole job on a prune the
+box's token is deliberately refused: `prune 'ct/9201': permission check failed - missing
+Datastore.Modify|Datastore.Prune` → `TASK ERROR: job errors` → `whole_guest_backup_failed` in the
+operator's inbox. Every week, on both boxes, about a backup that had already succeeded.
+
+**R-89 moved off-site pruning SERVER-SIDE** — ep0 runs a per-namespace prune job and box tokens stay
+write-only, so a box can never delete its own off-site history. The 2026-07-26 "two weeks" ruling was
+not reversed; where it is ENFORCED moved, and this value did not follow. The tier now writes
+`keep_last: 0`, which the agent's existing guard (`allowPBSPrune = !primary && keep_last > 0`) already
+reads as "never prune from the box" — no agent change needed.
+
+**VERIFIED BEFORE CHANGING IT** (read-only on ep0, 2026-08-04): prune jobs `prune-demo-felhom` and
+`prune-demo-hp` exist on datastore `felhom-offsite`, one per namespace, schedule 03:30, keep-last 2,
+and have run **every day since 2026-07-27 — 18 tasks, all `status=OK`**, the newest showing
+`retention options: --ns demo-felhom --max-depth 0 --keep-last 2` and keeping exactly two. Disabling
+the client-side prune without that check would have traded a weekly false alarm for unbounded growth.
+
+A gate now asserts the off-site tier carries no client-side prune, so the value cannot drift back
+quietly. The local tier's retention is untouched.
+
 ## 1.24.0 — a pre-existing backup target is granted too (2026-08-03, R-185)
 
 **`configure_backup_target` has two arms and only one of them granted.** The Case A arm creates the