hub v0.157.0: app_definition_refused (R-971), the vault time moves on a re-vault (R-954), the hub's own snapshot count (R-895 slice); uninstall knows felhom-thin-check

- hub: `app_definition_refused` in allowedEventTypes + operatorOnlyEvents (controller v0.328.0's catalog
  allow-list refusal); SaveHostRecoveryCredential moves set_at on a re-vault (found live: both rotated hosts
  kept their first vault's time); the daily key audit also lists the box's restic snapshots/ read-only over the
  login the hub already holds and logs count/newest/oldest (no alarm yet).
- installer (main only, rides the next tag): --uninstall removes /usr/local/sbin/felhom-thin-check (agent
  v0.159.0's bundle file); test_hostinstall.py knows it.
- runbook whole-guest-backup-orphan-thin.md: the human repair the agent's new orphan finding points to.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 2026-10-17 — the uninstall removes agent v0.159.0's new root helper (R-1012); not yet tagged
+
+`felhom-host-install.sh --uninstall` removes `/usr/local/sbin/felhom-thin-check`, the read-only orphan-thin check the
+agent's config bundle installs since v0.159.0; `test_hostinstall.py` names it among the bundle files (its
+`test_bundle_list_is_current` fails when the bundle gains a file the uninstall does not know). Pushing to `main`
+publishes nothing — this rides the next `installer-v…` tag. SCRIPT_VERSION unchanged.
+
 ## 2026-10-17 — `~/.config/credentials` deleted (R-1134)
 
 The operator's go, after every key in it was checked equal in the CC store. `read_credential.py`, `fb_probe.py` and