felhom-host-install.sh v1.9.0 — Pool.Audit in FelhomAgentGuest (audit A1)

Companion to felhom-agent v0.62.0: the stale-lock reaper reads GET /pools/felhom
as its ownership registry. Pool.Allocate does NOT satisfy the read (spike T2).
Idempotent upgrade via --rescope-acl (_ensure_role modifies to the exact set).
Rescope FIRST, agent second. + REUSE §2 errata: gitea-creds is NOT out-of-band
(committed in felhom.secret.yaml, live-consumed — rotation pending).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,13 +3,12 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
-- **2026-07-03 — SPIKE A1 (pool-membership read) COMPLETE** —
-  `documentation/audits/SPIKE-a1-pool-membership-read-2026-07-03.md`. **The A1 impl spec is now
-  unblocked** and must cite it: winner = `Pool.Audit` added to `FelhomAgentGuest`
-  (`felhom-host-install.sh` L183) + `GET /pools/felhom` cross-check in
-  `staleLockController.Guests()` (fail-safe skip). Enumeration proven pool-filtered under the
-  production token; fix is defense-in-depth for the broad-token precondition. Appendix: operator
-  follow-up to rotate + de-git the 3 committed secrets in `manifests/felhom.secret.yaml`.
+- **2026-07-03 — A1 CLOSED (host-install v1.9.0 + agent v0.62.0)** — `Pool.Audit` added to
+  `FelhomAgentGuest`; the agent's stale-lock reaper now intersects its scan with
+  `GET /pools/felhom` membership (fail-safe skip on read failure). Spike:
+  `documentation/audits/SPIKE-a1-pool-membership-read-2026-07-03.md`. Deploy order on any box:
+  rescope ACL first, then the agent. STILL PENDING (operator): rotate + de-git the 3 committed
+  secrets in `manifests/felhom.secret.yaml` (spike appendix; REUSE §2 errata added).
 - **2026-07-03 — hub v0.31.0 LIVE** (critical-severity ingest fix + UI badges; ArgoCD Synced/Healthy;
   live probe: critical event stored + operator email delivered).
 - **2026-07-03 — Felhom skills exist**: `skills/{felhom-build-deploy,felhom-ui-design,felhom-testing}`,