iso 1.26.1: ship /etc/felhom/ — the directory the bootstrap writes its state into

FIX for the Part-5 failure. felhom-bootstrap.sh writes the appliance token (:431), the pairing code
(:435) and .bootstrap-done into /etc/felhom/. The old stub-first-boot.sh created it explicitly
('install -d -m 0755 /etc/felhom /usr/local/sbin'); packaging dropped the env FILE correctly and the
DIRECTORY with it. Measured consequence on a real interactive install: the box registered at the hub,
could not persist its token, and polled 'HTTP 401 — still retrying' forever with no claim code.

- build-deb.sh now ships ./etc/felhom/ (0755, empty) and ASSERTS it, plus ./usr/local/sbin/ and
  ./lib/systemd/system/, as G13. RED-PROOFED: removing the install -d makes the build exit 3 with
  'is not in the package (G13)', and restoring it goes green.
- The gate gains G13 with the reasoning: G7/G8/G9 all passed on the broken package. G9 proves the
  payload is the right payload and says NOTHING about what the payload depends on.

ISO_VERSION -> 1.26.1.

documentation/runbooks/iso-release-gate.md

@@ -181,6 +181,24 @@ git rev-parse HEAD; git rev-parse origin/main # equal
 reference boxes cannot be rebuilt from `main`. A published image must never reach that state, and
 R-144 records a lab ISO that already has (`nested-probe`'s profile no longer exists).
 
+### G13 — every directory the payload writes into is IN the package
+
+```bash
+dpkg-deb -c /tmp/p.deb | awk '{print $6}' | grep -x './etc/felhom/'
+```
+**PASS =** present, along with `./usr/local/sbin/` and `./lib/systemd/system/`.
+
+*Why, and it is the most expensive lesson in this file:* the first release build passed G7, G8 **and
+G9** and still produced a box that could never pair. `felhom-bootstrap.sh` writes its appliance token
+(`:431`), its pairing code (`:435`) and `.bootstrap-done` into `/etc/felhom/`, and the package did not
+ship that directory — the old `stub-first-boot.sh` had created it explicitly and the packaging dropped
+it. The installed box registered at the hub, failed to persist the token, and then returned
+`HTTP 401 — still retrying` forever, with no claim code ever shown.
+
+**G9 proves the payload is the right payload. It says nothing about what the payload depends on.**
+Any future criterion of the form "the correct file is present" should be paired with one of the form
+"and everything it needs at run time is too". `build-deb.sh` asserts this itself and is red-proofed.
+
 ### G11 — A published checksum, and a verified round trip
 
 **PASS =** the `.sha256` and the manifest are uploaded beside the ISO, **and** the file downloaded from