docs: ISO train v1.25.0 — REPORT (belt/apt/R-63/gate/vault live), F9 resolved, R-63 shipped, nodes belt+vault, F8 checklist; critical golden<floor finding

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NKSN3gSg4TKVBBqkwW2djR

CONTEXT.md

@@ -22,6 +22,24 @@
   intact (its cleanup is the operator's, post-validation). R-71(a) day-0 ordering OPEN → next
   spec. Evidence: `REPORT.md` (2026-07-23).
 
+- **2026-07-23 — ISO train v1.25.0 + hub v0.73.0 (four rulings + rider).** host-install
+  1.17.0→1.18.0, build-felhom-iso 1.24.0→1.25.0, felhom-bootstrap R-63, hub v0.73.0. **Done +
+  live-verified:** (1) **F9 belt everywhere** — host-install installs the H1 OOB belt by default in
+  appliance mode (`--no-oob` opts out; byo still refuses), `oob.enabled` written so the agent
+  activates it; belt LIVE on both boxes, **login PROVEN on felhom-pve** (`felhom-op@demo-felhom`);
+  the orphaned operator identity was re-anchored to the operator's real machine (WG peer + SSH key
+  re-registered, ep0 forward rules persisted). (2) **apt** — `align_apt_repos` (appliance-only)
+  switches enterprise→no-subscription; LIVE-aligned both boxes (`apt-get update` clean). (3) **R-63**
+  — Lat2 console font before first paint. (4) **R-71 build-gate** — `assert_golden_ge_floor` in
+  build-felhom-iso + rule 5; red-proofed. (6) **root vault** — felhom-pve root rotated+vaulted+
+  verified over :22 (G1 parity). (7) **hub v0.73.0** — `offsite_stale` never-ran branch ANCHORED
+  (applied-only + consumed_at/escrow anchor; one-state-one-owner with `offsite_delivery_stuck`),
+  shipped+deployed, red-proofed. **CRITICAL live finding:** golden **0.153.0 < floor 0.156.0** in
+  production now — the R-71 gap is real; the gate correctly blocks a v1.25.0 build. **Remaining
+  (enforced-sequenced):** golden republish at 0.161.0 + operator vouch (password-gated) → then the
+  v1.25.0 ISO rebuild + nested drill. Evidence: `REPORT.md`, `scripts/CHANGELOG.md`,
+  `operations/nodes.md`.
+
 - **2026-07-23 — F10 offsite leg RESOLVED on demo-hp (diagnostic + designed-path repair + tier
   proof; no code changed).** The hub said "Provisioned" while the box said „Még nincs beállítva" —
   root cause: the day-0 managed update (0.153.0→0.156.0, 07-21 16:28) killed the offsite