Installer step 4b: vault first, then set, then a PVE login (R-1145); host key off curl's argv (review F4); harness green and a gate (R-1146); hub 0.158.0 deploy evidence; independent review + verdicts

Live on demo-hp (--rotate-recovery-only): vault time moved, new value 200, old 401. Harness 52/0;
the R1145 cases fail against HEAD. Publishes only with the next installer tag.

scripts/CHANGELOG.md

@@ -1,3 +1,19 @@
+## 2026-10-18 — step 4b vaults FIRST, then sets the password (R-1145); the host key off curl's argv; the harness is a gate (R-1146); not yet tagged
+
+- **R-1145:** step 4b (the full install and `--rotate-recovery-only`) now runs generate → PUT to the hub vault (200 =
+  stored) → chpasswd (one retry) → a PVE API login with the new value. A refused vault (a stale key included — the
+  independent review's F1) changes nothing; a set that fails twice after the vault leaves root on its previous password
+  and says so (its shadow line is fingerprinted before and after, never read out); a refused PVE login is said too.
+  The host key cannot read the vault back (by design), so the previous value cannot be re-vaulted — the next run fixes
+  that state. Live on demo-hp (`--rotate-recovery-only`): vault time moved, the new value 200, the old one 401.
+- **Review F4:** the host key rides a 0600 header file (`-H @file`), never curl's argv.
+- **R-1146:** shellcheck SC2066 fixed (a one-file loop became an `if`, same effect); GL8-F6's stale check now judges
+  where a line is (the uninstall's own dnsmasq, R-300, and the gate's hint text are allowed); the harness runs as gate
+  `hostinstall-harness` (`hostinstall_harness_gate.py`, fast; skips out loud on a runner without bash) with two decoys.
+  Harness: 52 passed, 0 failed (was 45/2). New cases R1145-a..e run the REAL step with fake commands; red-proofed against
+  HEAD (all five fail there).
+- Pushing to `main` publishes nothing — this rides the next `installer-v…` tag. SCRIPT_VERSION unchanged.
+
 ## 2026-10-18 — `felhom-host-install.sh --rotate-recovery-only` (R-1141); not yet tagged
 
 A new flag runs step 4b ALONE: a new random root@pam password, set with chpasswd and re-vaulted to the hub with the