docs: controller-swap narrow-grant Option A IMPLEMENTED (agent v0.45.0) — spike + multidrive pointers resolved

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

documentation/audits/SPIKE-multidrive-mutual-exclusion-2026-06-29.md

@@ -201,9 +201,13 @@ reports `bound_under_parent=true` for **both** felhom-usb + felhom-flash; the co
 zero `drive ABSENT` after); the real UI (`/settings`) shows **both drives Aktív concurrently**. Symptom
 gone.
 
-**Surfaced, NOT fixed (operator decision):** `GuestExec`'s general `pct exec <vmid> -- …`
-(controller-swap / managed auto-update) needs arbitrary root-in-guest — **not granted; controller-swap
-is broken under the non-root agent** until a narrow trust path is decided. **Deferred:** `sensors -j`
+**Surfaced, then RESOLVED (2026-06-29, agent v0.45.0):** `GuestExec`'s general `pct exec <vmid> -- …`
+(controller-swap / managed auto-update) needed arbitrary root-in-guest. Rather than grant it,
+controller-swap's only shell vector (`writeImage`'s `bash -c "printf … >"`) was replaced by a
+stdin-fed `tee`, making all 5 swap vectors fixed/read-only and allowlistable as `FELHOM_CONTROLLERSWAP`
+(no `bash -c`, no general `pct exec`). Spike-proven (`SPIKE-controllerswap-narrow-grants-2026-06-29.md`)
++ shipped; controller-swap works under the non-root agent again (live: 45/45 capability ok, negative
+controls denied). **Deferred:** `sensors -j`
 (no caller + lm-sensors not installed). **Left as-is:** the §4 host-side doubling (re-isolating the
 live parent would orphan the working guest slave — fixed grant takes effect on the next clean host
 boot). The §7 "guest_attached / pct config" note is **resolved**: `GuestConfig` is a Proxmox **API**