host-install v1.17.0: appliance guest auto-sizing (F5) + stale operator-key comment fix (R-16)

- F5: appliance mode auto-sizes guest RAM=clamp(host-4096,min 4096,max host-2048,ceil host-1024) + cores=host-1 min 2 when no explicit cap; explicit --memory/--cores always win. Harness F5 red-proof (8/16/32GB + edge + explicit).
- R-16 doc-drift: operator signing keys 'EMPTY by default' comment corrected (keys are PINNED).

scripts/hostinstall-mode-harness.sh

@@ -347,6 +347,47 @@ else
     verdict FAIL "GL8-F1b glob removal clears agent.json + every .bak* + the empty dir" "residue: $(ls -A "$f1dir" 2>/dev/null | tr '\n' ' ')"
 fi
 
+echo ""
+echo "--- F5 appliance guest auto-sizing (VALIDATION-n100) ---"
+# The auto-size log line is emitted right after mode validation (BEFORE any PVE/hub contact), so it
+# is asserted portably on ANY host — the later pipeline dies for lack of PVE, but the sizing already
+# happened. RED-PROOF: pre-fix, appliance passes NO cap → the golden 2 GB default reaches the guest
+# (no auto-size line at all); post-fix, the formula value is logged (and flows into the provision
+# args via cap_args). Host reads are faked via FELHOM_FAKE_MEMTOTAL_MIB / FELHOM_FAKE_NPROC.
+f5_run() { # <memtotal_mib> <nproc> [extra install args...]
+    local mt="$1" np="$2"; shift 2
+    FELHOM_INSTALL_STATE_DIR="$STATE_OVERRIDE_ENV" FELHOM_FAKE_MEMTOTAL_MIB="$mt" FELHOM_FAKE_NPROC="$np" \
+        bash "$SCRIPT" --customer-id t --mode appliance --dry-run "$@" </dev/null 2>&1 || true
+}
+while read -r f5_mt f5_np f5_mem f5_cores; do
+    [[ -z "$f5_mt" ]] && continue
+    o=$(f5_run "$f5_mt" "$f5_np")
+    if echo "$o" | grep -q "auto-sized guest RAM: ${f5_mem} MiB" && echo "$o" | grep -q "auto-sized guest cores: ${f5_cores} "; then
+        verdict PASS "F5 auto-size host ${f5_mt}MiB/${f5_np}c -> guest ${f5_mem}MiB/${f5_cores} cores"
+    else
+        verdict FAIL "F5 auto-size host ${f5_mt}MiB/${f5_np}c -> guest ${f5_mem}MiB/${f5_cores} cores" \
+            "got: $(echo "$o" | grep -i auto-sized | tr '\n' '; ')"
+    fi
+done <<'F5TABLE'
+8192 8 4096 7
+16384 8 12288 7
+32768 16 28672 15
+F5TABLE
+# Edge: a host below the min clamp — the min (4096) wins but is capped at host-1024.
+o=$(f5_run 4096 2)
+if echo "$o" | grep -q "auto-sized guest RAM: 3072 MiB"; then
+    verdict PASS "F5 auto-size small host 4096MiB -> 3072MiB (min capped at host-1024)"
+else
+    verdict FAIL "F5 auto-size small host 4096MiB -> 3072MiB" "got: $(echo "$o" | grep -i 'auto-sized guest RAM' | tr '\n' '; ')"
+fi
+# Explicit flags ALWAYS win: NO auto-size line (byte-identical to the pre-fix no-autosize behavior).
+o=$(f5_run 16384 8 --memory 8192 --cores 4)
+if ! echo "$o" | grep -qi "auto-sized"; then
+    verdict PASS "F5 explicit --memory/--cores suppress auto-sizing (explicit wins untouched)"
+else
+    verdict FAIL "F5 explicit --memory/--cores suppress auto-sizing" "auto-size line present despite explicit flags"
+fi
+
 echo ""
 echo "--- PVE tier ---"
 if ! command -v pveum >/dev/null 2>&1 || [[ "$(id -u)" != 0 ]]; then