docs(H1): doc06 §4.5/§4.6 amendment + endpoint runbook §9 + scripts CHANGELOG + REPORT + CONTEXT

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

scripts/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install — --enable-oob installs the dedicated felhom-sshd OOB instance + belt (TASK H1) (2026-07-05)
+
+- `--enable-oob` + `install_oob` (in step 5): lays down the STATIC OOB parts — `/etc/felhom-sshd` tree
+  + a dedicated ed25519 host key + the `felhom-op` login user + its scoped `/etc/sudoers.d/felhom-op`
+  (visudo-validated) + the `felhom-sshd.service` unit (**RuntimeDirectory-guarded** — refuses the G1
+  incident cause) enabled-not-started (the agent renders the config) + the static `inet felhom_oob`
+  nft table (`nft -c`-checked) + its boot loader `felhom-oob-nft.service`. The agent reconciles the
+  DYNAMIC parts (port claim, config, operator authorized_keys, belt set elements) once `oob.enabled`.
+- Uninstall (step 4b3): stops/disables felhom-sshd + the belt loader, removes both units + the config
+  tree + belt table + `felhom-op` user/sudoers; NEVER touches the stock sshd/:22/`/etc/ssh`.
+
 ## felhom-host-install — break-glass credential + management-plane watchdog install (TASK G1) (2026-07-05)
 
 - `step_break_glass` (new step 4b): generates a strong root@pam console password (`openssl rand`,