felhom-host-install.sh v1.9.0 — Pool.Audit in FelhomAgentGuest (audit A1)

Companion to felhom-agent v0.62.0: the stale-lock reaper reads GET /pools/felhom
as its ownership registry. Pool.Allocate does NOT satisfy the read (spike T2).
Idempotent upgrade via --rescope-acl (_ensure_role modifies to the exact set).
Rescope FIRST, agent second. + REUSE §2 errata: gitea-creds is NOT out-of-band
(committed in felhom.secret.yaml, live-consumed — rotation pending).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

scripts/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install.sh v1.9.0 — Pool.Audit for the stale-lock reaper (A1) (2026-07-03)
+
+Companion to felhom-agent v0.62.0 (audit A1: pool-membership ownership check). `PVE_PRIVS_GUEST`
+gains **`Pool.Audit`** (12 → 13 privs, granted at `/pool/felhom` via the existing FelhomAgentGuest
+role) so the agent can read `GET /pools/felhom` — its stale-lock reaper's ownership registry.
+`Pool.Allocate` does NOT satisfy the read (spike SPIKE-a1-pool-membership-read-2026-07-03 T2).
+No structural change: `_ensure_role` already `role modify`s to the exact priv set, so re-running
+`--rescope-acl` (or a fresh install) upgrades an existing box idempotently; `remove_scoped_acl`
+deletes by role name and needs nothing. **Deploy order on a live box: rescope FIRST, then deploy
+agent v0.62.0** — the added read priv is harmless to an older agent, while the new agent on an old
+ACL fail-safes its reaper (skips) and reports `pve:pool-read` degraded until the rescope lands.
+
 ## docs — SPIKE: A1 pool-membership read for the stale-lock reaper (2026-07-03)
 
 Findings doc `documentation/audits/SPIKE-a1-pool-membership-read-2026-07-03.md`. Live-probed on