Apps burndown (controller 0.321.0 released): R-1097, R-1102, R-1101, R-1095, R-1098 closed; R-1103 opened; build-hub.sh 1.25.0

build-hub.sh refuses an existing tag and an unanswered registry (test_build_hub_push_once.sh, red-proved).
Register 179 -> 175. R-1067 stays BLOCKED: Tester-2 reports 0.292.0. Design notes in 02 and 07; STATUS;
evidence audits/burndown-apps-2026-10-16/; REPORT-burndown-apps-2026-10-16.md.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 2026-10-16 — build-hub.sh 1.25.0: a version number is pushed once (R-1098)
+
+`scripts/build-hub.sh` refuses `--push`/`--multiarch` of a tag the registry already has, and refuses when the registry
+cannot say (unreachable, auth failure) — before the build, the controller `build.sh` rule (`09-update-architecture.md`
+§0). Local builds are unaffected. Test: `scripts/test_build_hub_push_once.sh` (6 cases, the real script, a fake
+`docker`), red-proved: with the check removed, 5 cases fail. The tree-gate test still passes. No hub image change.
+
 ## 2026-10-16 — felhom-host-install.sh 1.33.0: the data volume by the ruled table; the internal data place (step 5b)
 
 `architecture/16-storage-physical-identity.md` §5, §7 (sizes ruled by the operator 2026-10-16 after the build B space check,