host-install v1.3.0: --uninstall (clean revert) + pre-flight guards

Colleague-safety batch #1+#2 (script-only). Adds a guarded, dry-run-aware
--uninstall local host teardown (guest -> agent -> pveum(ACL,token,user,role)
-> golden(opt-in) -> state file), with ours-check on the /etc/felhom-bootstrap
mount, typed vmid confirm, other-Felhom-guests safe-skip, and idempotent
tolerate-absent. Records customer_id + provisioned_vmid into the install state
(_state_put/_state_get) so uninstall resolves its target automatically. Adds
three provision pre-flight guards: multi-node (--node required), archive-storage
exists, and a RAM-floor WARN. Validated dry-run-only on felhom-pve.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install.sh v1.3.0 — `--uninstall` (clean revert) + pre-flight guards (2026-07-01)
+
+Colleague-safety batch #1+#2. Adds a first-class, guarded **`--uninstall`** teardown so an operator can
+cleanly back out of a trial install, plus three provision pre-flight guards that stop common footguns.
+Script-only; no agent/hub/controller change.
+
+- **`--uninstall` (local host teardown — no hub contact, no passphrase).** Reverses an install in the
+  install-order's reverse: **guest → agent(unit/sudoers/binary/state/user) → pveum(ACL,token,user,role)
+  → golden(opt-in) → state file.** Every mutation goes through `run()` so `--dry-run` prints the full
+  plan and executes nothing. Safety:
+  - **Ours-check:** refuses to destroy a guest that lacks the `/etc/felhom-bootstrap` bind mount (matched
+    by the constant guest *path*, not a hardcoded `mpN` slot — on the demo host it's `mp9`), unless
+    `--force`.
+  - **Typed confirmation:** must type the vmid to confirm PERMANENT destruction (read from `/dev/tty`;
+    skipped only under `--dry-run`, where nothing is destroyed).
+  - **Other-guests guard:** if any OTHER Felhom guest remains, destroys only the target and **leaves the
+    agent + PVE token + state in place** (re-run with `--force` to remove host-level anyway — orphans the
+    others).
+  - **Never removes the `sudo` package**; never contacts the hub (the host record intentionally persists).
+  - Presence-checked + idempotent: an already-absent guest/unit/sudoers/binary/user/ACL/token/role is a
+    tolerated skip, not an error. The `pveum role delete` runs only after its ACL grants are gone (PVE
+    refuses to delete a referenced role). Confirmed PVE 9 ACL-delete form:
+    `pveum acl delete / --users|--tokens <x> --roles FelhomAgent`.
+  - Target vmid resolves from `--vmid`, else the recorded `provisioned_vmid` (else dies). A `--vmid` that
+    disagrees with the recorded one needs `--force`.
+  - **`--remove-golden`:** with `--uninstall`, also delete the golden vzdump from the archive storage
+    (`pvesm free`); otherwise it is left in place.
+- **Install state now records `customer_id` + `provisioned_vmid`** (new `_state_put`/`_state_get` helpers,
+  dry-run-guarded like `_state_mark`; the `completed[]` shape is untouched) so a later `--uninstall`
+  resolves its target automatically and safely.
+- **Pre-flight guards (provision mode):**
+  - **Multi-node guard** — on a 2+-node cluster, `die` (naming the nodes) unless `--node` is explicit
+    (new `NODE_EXPLICIT`); single-node keeps the current auto-pick. No-op under `--skip-provision`.
+  - **Archive-storage-exists guard** — verify `--archive-storage` appears in `pvesm status` (else `die`);
+    no-op under `--skip-provision`.
+  - **RAM floor (WARN, never fatal)** — warn when `MemAvailable < 2048 MiB`.
+  All three run inside `step_preflight` (before any mutation) so they also fire under `--dry-run`.
+- **Validated dry-run-only on felhom-pve** (single-node, live guest 9201): T-A full uninstall plan, T-C
+  not-ours refusal (red-proof), archive-missing `die`, RAM line, other-guests detector, state round-trip;
+  confirmed 9201 + agent + pveum + state untouched after all dry-runs. `bash -n` + `shellcheck` clean
+  (0 new warnings vs. baseline; the 2 pre-existing SC2015 in `step_verify` are unchanged). **NOT yet
+  live-validated (awaiting a supervised run):** a real live `--uninstall` (guest destroy + pveum removal)
+  and the multi-node guard on an actual cluster.
+
 ## felhom-host-install.sh v1.2.0 — /dev/tty passphrase read + vmid auto-detect (2026-07-01)
 
 Two operator-experience fixes so a colleague can install online (via the hub's new "Option 1: Online