host-install v1.6.0: pool-scoped token ACL (3-role) + --rescope-acl retrofit

step_token now grants 3 scoped roles (Guest@/pool/felhom incl. Pool.Allocate,
Store@each PVE_STORAGES incl. felhom-pbs, Base=Sys.Audit+SDN.Use@/) to both user
and token, pool-before-token, and removes any pre-3b broad / grant. New
--rescope-acl migrates existing installs (add-before-remove; supervised).
--uninstall removes both scoped + old shapes. Post-provision pool_add_guest
dropped (agent restore --pool owns membership, v0.53.0). Validated dry-run on
felhom-pve; bash -n + shellcheck clean. LIVE rescope+swap is the supervised STOP.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Felhom scripts — Changelog
 
+## felhom-host-install.sh v1.6.0 — pool-scoped token ACL (3-role) + `--rescope-acl` retrofit (2026-07-01)
+
+Colleague-safety batch #4 phase b (script half; agent half = v0.53.0). Moves the agent token's dangerous
+privileges off `/` (which spanned every guest + storage) to `/pool/felhom` + `/storage/<targets>`, so on
+a shared box the token can only touch Felhom's own guests + storages. Validated by
+`documentation/audits/SPIKE-pool-scoped-acl-2026-07-01.md` (PASS) — implemented here.
+
+- **3-role scoped ACL (`step_token` rewrite).** Replaces the single `FelhomAgent` role granted at `/`
+  with three roles, each granted to BOTH the user AND the token (privsep intersection): `FelhomAgentGuest`
+  (`VM.*` + `Pool.Allocate`) @ `/pool/felhom`; `FelhomAgentStore` (`Datastore.*`) @ each of
+  `PVE_STORAGES` (default `local local-lvm felhom-pbs` — the offsite PBS MUST be included, SPIKE
+  residual #1; `--acl-storages` overrides); `FelhomAgentBase` (`Sys.Audit SDN.Use`) @ `/`. Helpers
+  `apply_scoped_acl`/`remove_scoped_acl`/`_grant`/`_ensure_role`.
+- **Pool before token.** `ensure_felhom_pool` runs at the top of `step_token` (always, incl.
+  `--skip-provision`) so `/pool/felhom` exists before it's granted on.
+- **Re-install safety.** `step_token` also removes the pre-3b broad `/` grant + `FelhomAgent` role if
+  present (`remove_old_broad_acl`, tolerate-absent), so a re-install can't leave the old grant unioned
+  with the scoped one. The post-provision `pool_add_guest` is gone (the agent's `restore --pool` makes
+  the guest a member atomically — v0.53.0).
+- **`--rescope-acl` retrofit** (new mode, mirrors `--adopt-pool`): migrate an existing install — ensure
+  the pool + guest membership, apply the scoped grants, THEN remove the old broad grant (add-before-
+  remove: the token is never grant-less mid-migration). Prints the "now deploy agent ≥ v0.53.0"
+  ordering reminder. Idempotent + dry-run-aware. **SUPERVISED** (run with the agent stopped — the scoped
+  ACL and the pool-param agent are mutually dependent; §13 of the task).
+- **`--uninstall`** now removes the scoped grants + 3 roles AND the pre-3b broad grant/role (both
+  tolerate-absent → works on either shape), keeping the pool delete-if-empty (v1.5.0).
+- **Validated on felhom-pve** (dry-run): T-A fresh install (pool-before-token, 3 roles once, scoped
+  grants incl. `/storage/felhom-pbs`), `--rescope-acl` (add scoped → remove old `FelhomAgent`), T-F
+  uninstall (old-shape cleanup + pool not-empty skip). `bash -n` + `shellcheck` clean (0 new warnings).
+  **The live rescope + agent swap is the supervised STOP** — not run here.
+
 ## felhom-host-install.sh v1.5.0 — `felhom` pool by default + `--adopt-pool` retrofit + uninstall teardown (2026-07-01)
 
 Colleague-safety batch #4 phase a. Every Felhom-managed guest now joins a dedicated **`felhom` pool**