Installer step 4b: vault first, then set, then a PVE login (R-1145); host key off curl's argv (review F4); harness green and a gate (R-1146); hub 0.158.0 deploy evidence; independent review + verdicts

Live on demo-hp (--rotate-recovery-only): vault time moved, new value 200, old 401. Harness 52/0;
the R1145 cases fail against HEAD. Publishes only with the next installer tag.

scripts/repo_gates.py

@@ -10,6 +10,7 @@ Gates, in order (all must pass; **non-zero exit on any failure**):
 
   1. site            website HTML: BOM, emoji, nav/footer, analytics, CDN, tokens, cache-busting
   2. hostinstall     felhom-host-install.sh's five drill-swept invariants (+ R-94's absent-version)
+  2b. hostinstall-harness  scripts/hostinstall-mode-harness.sh as a gate (R-1146; skips out loud without bash)
   3. hub-confirm     no native confirm()/prompt() in hub templates
   4. manifest-bearer no bearer-shaped literal anywhere in manifests/
   5. reuse-refs      every path cited by this repo's REUSE.md still resolves
@@ -137,6 +138,8 @@ SCRIPTS = os.path.join(ROOT, "scripts")
 GATES = [
     ("site",            os.path.join(SCRIPTS, "site_gates.py"),         [],       True, False),
     ("hostinstall",     os.path.join(SCRIPTS, "hostinstall_gates.py"),  [],       True, False),
+    # R-1146 — the installer's own harness (incl. R-1141's and R-1145's cases) was red for weeks and run by nothing.
+    ("hostinstall-harness", os.path.join(SCRIPTS, "hostinstall_harness_gate.py"), [], True, False),
     ("hub-confirm",     os.path.join(SCRIPTS, "hub_confirm_gate.py"),   [],       True, False),
     ("manifest-bearer", os.path.join(SCRIPTS, "manifest_bearer_gate.py"), [],     True, False),
     ("reuse-refs",      os.path.join(SCRIPTS, "reuse_refs_check.py"),   [ROOT],   True, False),