Installer step 4b: vault first, then set, then a PVE login (R-1145); host key off curl's argv (review F4); harness green and a gate (R-1146); hub 0.158.0 deploy evidence; independent review + verdicts

Live on demo-hp (--rotate-recovery-only): vault time moved, new value 200, old 401. Harness 52/0;
the R1145 cases fail against HEAD. Publishes only with the next installer tag.

documentation/runbooks/break-glass.md

@@ -88,7 +88,8 @@ Fix the cause; the three layers are the safety net, not the cure.
   before the web-console path was used. A working break-glass path independent of sshd must always exist.
 - **Rotate the console credential ALONE** with `sudo bash felhom-host-install.sh --rotate-recovery-only`
   (R-1141; try it first with `--dry-run`). It runs step 4b and nothing else: a new random `root@pam`
-  password, set with `chpasswd` and re-vaulted to the hub with the host key from the agent's own config
+  password, VAULTED at the hub FIRST and only then set with `chpasswd`, then checked with a PVE login (R-1145, 2026-10-18 —
+  a refused vault changes nothing), with the host key from the agent's own config
   (`/etc/felhom-agent/agent.json`). It does NOT reinstall or change the agent, its config or the root
   files, needs no passphrase or customer id, checks that the hub answers (`/healthz` 200) before the
   password changes, and refuses a byo host (also an agent config whose `deployment_mode` is not