R-50 runbook: Part C (agent 0.95.0 -> demo-hp) + qm300 forensic

- deployed agent 0.95.0 to demo-hp via break-glass (0.93.0->0.95.0), binary
  sha-verified, caps 68/68 ok, guest 9201 untouched, hub confirms 0.95.0
- forensic: qm300 had no qmdestroy; it died with the mid-July N100 reprovision
- nodes.md: fleet agents 0.95.0; demo-hp deploy note

documentation/operations/nodes.md

@@ -13,7 +13,7 @@
 | Firmware | AMI AN3PLUS-class | **AMI M42 v01.10 (11/11/2020)** |
 | PVE node name | `demo-felhom` | `felhom-host` |
 | Customer | `demo-felhom` | `demo-hp` |
-| Agent | 0.92.1 | 0.92.1 |
+| Agent | 0.95.0 | 0.95.0 |
 | SSH alias | `felhom-pve` | **`demo-hp`** |
 | Tailnet | `100.70.170.35` | **`100.76.96.79`** |
 | Loader used to install | `mkimage` (unsigned, SB **off** — firmware workaround) | **`shim`, Secure Boot ENABLED** |
@@ -57,7 +57,7 @@ that looked installed and could never call home. Repaired on the console by brid
 
 Current, post-repair: `vmbr0` static `192.168.0.87/24`, gw `192.168.0.1`, bridge-port `enp2s0f0`.
 No trace of `192.168.100.2` remains. `wg-felhom` `10.77.0.3/32` up to the hub. Guest **9201
-`demo-hp`** running. Agent **0.93.0** (behind demo-felhom's 0.95.0 — publish when convenient).
+`demo-hp`** running. Agent **0.95.0** (deployed 2026-07-25 via break-glass; `.bak-0.93.0` retained; caps 68/68 ok).
 
 ### Designated drill + build VM host (operator ruling, 2026-07-25)