golden 0.219.0 baked, published and round-trip verified (NOT vouched)

Baked in the drill VM per RUNBOOK-manual-build.md 4.0/4.1, carrying controller
v0.219.0 (R-356).

  GOLDEN_VERSION 0.219.0
  GOLDEN_SHA256  67b46f78f8ed9c7b1876265ab1bde9ec6798897898b1836acece9f3864a2aeb6
  656832571 bytes

All five pass markers matched, both negative controls at 0. Verified by ROUND
TRIP - the published object downloaded again and its sha recomputed - not by the
number the script printed.

Both token-leak greps were proved able to convict before their zeros were
believed: planted copy grepped 1, shredded, then the 0 accepted.

Teardown complete: guest 9100 purged, four secret/script files shredded after the
log was copied out, qemu exited, disk reverted to virgin. The revert first
refused while qemu held the image, which is the runbook's own no-holder proof.

NOT vouched - that is a three-field operator save (golden_version 0.219.0,
agent_version 0.130.0, min_agent 0.129.0).

STATUS.md

@@ -12,10 +12,13 @@ NOT yet delivered: two steps below are yours.**
 *This section is allowed to be longer than one screen, and each item says what happens if you do
 nothing.*
 
-1. **Bake and vouch a machine image carrying controller 0.219.0.** Only you can vouch it.
-   **If you do nothing:** a machine installed today receives 0.218.0 — the release below exists, is
-   tested and is on the shelf, and no new machine gets it. The build system is red until this is done
-   and will mail you about it on every push. *(register: R-334's gate, now firing for 0.219.0)*
+1. **Vouch the golden carrying controller 0.219.0** — Hub → Configuration → Day-0 artifacts.
+   **It is baked, published and round-trip verified** (`documentation/tests/golden-0.219.0-2026-08-22/`);
+   only the vouch is left, and only you can do it. **It is a THREE-field save, not one:**
+   `golden_version` → **0.219.0**, `agent_version` → **0.130.0**, `min_agent` → **0.129.0**. Moving
+   `golden_version` alone ships this controller onto an agent older than it declares it needs.
+   **If you do nothing:** a machine installed today still receives 0.218.0 — the image exists, on the
+   shelf, undelivered. Reversible: re-select the old values and Save.
 2. **Then raise the auto-update floor to 0.219.0 — last, in a separate save.** It acts within seconds.
    **If you do nothing:** every existing machine stays on 0.218.0, so the fix below reaches nobody and
    40 of 53 apps stay un-restorable on the actual fleet. *(register: R-343's rule)*