docs+scripts: TASK-E parts 4-7 - operator one-pager, rulings, hub build.sh adoption

PROMPT-TEMPLATE: standard 'For the operator' plain-language section, mandatory
for M+ tasks and anything with a STOP.

ROADMAP rulings (operator, 2026-07-21): R-25b full-teardown cascade with three
acks + typed name (M-sized, spec to follow, no longer blocks R-3); R-11 channel
= direct Messenger, doc is the architect's; R-42 option (a), sidecars follow the
app; R-17 delete the archive - spike-lite found NO tooling verb targets it, so
it is an operator console action; R-4 complete (freemail.hu verified).
R-55 + R-41 slice 1 marked shipped; new R-56 (app difficulty classification -
the constructive half of the glance ruling).

scripts/build-hub.sh v1.23.0: the hub build script was outside any repo. Adopted
verbatim + versioned; the build-dir path is now a symlink to it.

felhom-testing skill: the ~1/5 recovery-code 'known flake' is retired - it was a
real defect the test was correctly detecting.

scripts/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Felhom scripts — Changelog
 
+## build-hub.sh v1.23.0 — the hub build script enters the repo (2026-07-21)
+
+It never was in one. `/mnt/5_hdd/felhom.eu/build/felhom-hub/build.sh` lived only in a DooPlex build
+directory — unversioned, unreviewed, un-diffable and gone with the box, while being the only way the
+hub image gets built. Recorded as a follow-up in `felhom.eu/REPORT.md` §6; adopted here.
+
+Adopted verbatim — the build logic is byte-identical (verified by diff), and the only additions are
+a `SCRIPT_VERSION` constant echoed in the banner and a header naming the canonical/operative split.
+The build-dir path is now a **symlink** to this file, so there is one source of truth and a repo edit
+is live immediately (the `install_skills.py` pattern). The previous copy is retained beside it as
+`build.sh.pre-adopt-2026-07-21`.
+
+It already carried the GitOps deploy hint fixed earlier in the week (manifest bump → hard-refresh →
+deliberate sync, and the named trap that `kubectl set image` / `kubectl apply` are silently reverted
+by the next ArgoCD sync) — that wording now lives in git along with the rest of it.
+
 ## install_skills.py — cross-platform (POSIX symlink / Windows junction) (2026-07-19)
 
 Claude Code now runs on DooPlex (Debian 13), where `mklink /J` does not exist — the script would