ISO train v1.25.0 code: OOB belt default appliance leg (F9) + apt no-subscription (Part2) + R-63 Lat2 console font + R-71 golden>=floor build gate

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NKSN3gSg4TKVBBqkwW2djR

scripts/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Felhom scripts — Changelog
 
+## ISO train v1.25.0 — the belt goes fleet-wide, the repo goes free, the screen learns ő, fresh boxes boot at the floor (2026-07-23)
+
+Four rulings from 2026-07-23. host-install **1.17.0 → 1.18.0**, build-felhom-iso **1.24.0 → 1.25.0**,
+felhom-bootstrap R-63 font.
+
+- **Part 1 (F9) — the OOB belt is a DEFAULT appliance leg.** `felhom-host-install.sh`: appliance mode
+  now installs the H1 belt (felhom-sshd + static `inet felhom_oob` table + felhom-op) unless `--no-oob`;
+  byo still refuses `--enable-oob` (owner-consented, deliberate exclusion — flagged, unchanged). The
+  config writer now sets `oob.enabled=true` when the belt is installed, so the agent activates it (claims
+  a port, renders the sshd config, fills the belt sets) instead of the units sitting inert — the
+  pre-v1.25.0 state that left the belt unusable on both fleet boxes (07-22 power-outage audit F9). byo
+  config asserts unchanged (they already refuse `oob.enabled`). The belt is lockout-SAFE with no operator
+  peer yet (empty sets + no key = no access granted, `:22` untouched). **Live: installed + validated
+  end-to-end on felhom-pve** (operator WG peer → wg-felhom → belt → felhom-op login PROVEN) **and
+  installed on demo-hp** (same infra; login is the same mechanism).
+- **Part 2 (apt) — enterprise → no-subscription on fresh appliance installs.** New idempotent
+  `align_apt_repos` (appliance-only; runs before the first apt op): disables the PVE/ceph **enterprise**
+  `.sources` (deb822 `Enabled: no`) or legacy `.list`, adds `pve-no-subscription.sources` (suite+keyring
+  derived from the enterprise file), `apt-get update` must exit clean. Scoped to the Proxmox-managed repos
+  only; the owner's lists are never touched; no upgrades run.
+- **Part 3 (R-63) — the console learns ő/ű.** `felhom-bootstrap.sh` loads a Latin-2 console font
+  (`Lat2-Terminus16` → `Lat2-Fixed16` → `Lat2-Terminus14`) ONCE before the first paint (idempotent,
+  best-effort — never blocks boot). Fixes the R-59 network screen (élő/telepítő/ellenőrizze) and the
+  pairing banner (képernyő/teendő) rendering ő as blanks. Lat2 fonts ship in the trixie/PVE base, so no
+  copy rewording was needed.
+- **Part 4 (R-71 mitigation) — every ISO build asserts golden ≥ managed floor.** `build-felhom-iso.sh`
+  gains `ver_ge` + `assert_golden_ge_floor` (runs before workspace/mint; `die`s with both versions on
+  `golden < floor`; `FELHOM_ASSERT_GOLDEN`/`FELHOM_ASSERT_FLOOR` inputs; unset warns loudly, never a
+  silent pass). Red-proofed both directions (floor>golden → exit 1; golden≥floor → OK). Standing rule 5
+  added to `publish-train-rules.md`. Closes the day-0 update-vs-bridge race window at its source
+  (DIAG-f10 / R-71). ISO_VERSION → 1.25.0.
+
 ## ISO train v1.24.0 — the box that can never call home learns to say so, heal itself, and let you in (R-59 + R-60 + R-61) (2026-07-22)
 
 All three findings are from the HP t740 install (2026-07-21). Proven end-to-end on a nested