host-install v1.8.0: install the guarded-mkfs wrapper (Impl-1 Part B)

step_agent_install now fetches configs/felhom-mkfs-guarded.sh (bash -n validated)
and installs it 0755 root to /usr/local/sbin/felhom-mkfs-guarded BEFORE the
sudoers (which — from agent v0.54.0 — allowlists only the wrapper, not raw mkfs,
plus read-only pvs/zpool). Live-validated on felhom-pve. bash -n + shellcheck clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/felhom-host-install.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 #===============================================================================
-# felhom-host-install.sh v1.7.0
+# felhom-host-install.sh v1.8.0
 # Day-0 host-bootstrap for a Felhom Proxmox host (operator-deploy model).
 #
 # Run by the operator on a FRESHLY-PVE-INSTALLED box (after a manual PVE install
@@ -104,7 +104,7 @@
 
 set -euo pipefail
 
-SCRIPT_VERSION="1.7.0"
+SCRIPT_VERSION="1.8.0"
 
 #-------------------------------------------------------------------------------
 # Logging (mirrors felhom-controller/scripts/docker-setup.sh)
@@ -1208,6 +1208,19 @@ step_agent_install() {
         fi
     fi
 
+    # Guarded-mkfs wrapper (Impl-1 Part B) — the ONLY mkfs path the sudoers permits. Install it BEFORE
+    # the sudoers (which allowlists it), 0755 root:root under /usr/local/sbin. bash -n before install.
+    if $DRY_RUN; then
+        log_dry "fetch configs/felhom-mkfs-guarded.sh ; bash -n ; install 0755 -> /usr/local/sbin/felhom-mkfs-guarded"
+    else
+        local wtmp; wtmp=$(mktemp -t felhom-mkfs.XXXXXX)
+        fetch_raw "configs/felhom-mkfs-guarded.sh" "$wtmp"
+        bash -n "$wtmp" || { rm -f "$wtmp"; die "fetched felhom-mkfs-guarded.sh failed bash -n — refusing to install"; }
+        install -m 0755 -o root -g root "$wtmp" /usr/local/sbin/felhom-mkfs-guarded
+        rm -f "$wtmp"
+        log_success "  installed /usr/local/sbin/felhom-mkfs-guarded (0755, the guarded mkfs path)"
+    fi
+
     # Sudoers — fetch the canonical file, validate with visudo -cf BEFORE installing (0440 root:root).
     if $DRY_RUN; then
         log_dry "fetch configs/felhom-agent.sudoers ; visudo -cf ; install 0440 -> $AGENT_SUDOERS"