build-hub.sh v1.24.0: refuse a stale or dirty tree (R-1021)

Fetch, pull --ff-only, then refuse unless clean and HEAD == origin/main; the
commit label is read after the pull. Test with a stub docker: 6 cases; the
old script gets 5 wrong. Evidence for the catalog gate unclean-boot-images.

scripts/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 2026-10-14 — build-hub.sh v1.24.0: refuses a stale or dirty tree (R-1021)
+
+- Fetches, then REFUSES (exit 1, naming the leftovers' home and the own-clone route) unless the tree is clean, the
+  `git pull --ff-only` succeeds, and `HEAD == origin/main`. `GIT_COMMIT` is read AFTER the pull. Until now a failed
+  pull only warned and the commit was read before it — on 2026-10-14 the shared checkout was 44 commits behind and the
+  script would have built old hub code under the new version label.
+- `FELHOM_HUB_REPO_DIR` builds from another clone (same rule). No `--allow-dirty`: no current runbook needs one.
+- `test_build_hub_tree_gate.sh` (new): a scratch origin + clone, a STUB `docker` first on PATH (nothing is built or
+  pushed). Six cases — untracked file, modified file, diverged (pull blocked), unpushed commit → refused; behind with a
+  clean pull → passes and the Commit line names the NEW head; clean → passes. Red-proof: the old script (only
+  `REPO_DIR` made overridable) gets 5 of 6 wrong (`documentation/audits/immich-repair-2026-10-14/E/bh-old.txt`).
+
 ## 2026-10-14 — host install: the uninstall removes the new root helper felhom-vzdump-partial-clean (R-1006)
 
 - `felhom-host-install.sh` step 4d removes `/usr/local/sbin/felhom-vzdump-partial-clean` (agent v0.156.1's bundle installs