installer v1.23.0 — publishing becomes an act, not a side-effect (R-110, R-183)

Two channels moved off main in the same change, because either one left behind
makes the other cosmetic.

Channel 1 — the served script. webpage.yaml git-synced /scripts/ from
--branch=main every 30s and nginx served that tree, so pushing this file WAS
publishing it: within half a minute it was what every new machine downloaded and
ran as root, with no staging and no rollback but another push. The sync is now
SPLIT: the website keeps tracking main at the same cadence (a copy edit must
never need a release) and /scripts/ tracks the tag installer-v<SCRIPT_VERSION>.

PROVEN before the manifest was touched: git-sync v4.4.0 follows a tag AND
notices a MOVED one — measured on a throwaway sync against this repo,
"update required ... local:<old> remote:<new>" -> "updated successfully",
within one period. The moved-tag half is what the publish model rests on.

Channel 2 — the sixteen files fetched at run time. fetch_raw pulled from
$AGENT_REPO/raw/branch/main; it now pulls raw/tag/v$ART_AGENT_VER. That is a
correctness fix, not only a channel one (R-183): a fresh install fetched the
vouched agent BINARY while taking its unit file, sudoers and guarded wrappers
from whatever main held. Two refs, one install, nothing compared them. Their
correct ref was never SCRIPT_VERSION — they do not live in this repo.

No fallback to a branch: a vouched version whose tag is missing fails loudly
rather than quietly serving main.

Channel 3 — the URL — needed no change, recorded rather than left silent:
https://felhom.eu/scripts/felhom-host-install.sh never carried a ref, so both
producers follow the tag with no edit. No hub change, no hub version bump.

Gate 6 in hostinstall_gates.py pins all three structurally with no network, so
it stays in --fast and runs in CI. It deliberately does NOT assert "a tag exists
for the current SCRIPT_VERSION": that would go red on the very push that bumps
the version, before publishing — and publishing being separate is the ruling.

scripts/felhom-host-install.sh

@@ -184,7 +184,7 @@
 
 set -euo pipefail
 
-SCRIPT_VERSION="1.22.0"   # the SINGLE version source (F-1): -h and the run banners follow it.
+SCRIPT_VERSION="1.23.0"   # the SINGLE version source (F-1): -h and the run banners follow it.
                           # The hub used to carry a copy for its Setup tab; R-94 DELETED it
                           # (2026-08-02) because the hub cannot know which version a box runs —
                           # the Setup command fetches this script at run time. scripts/
@@ -492,12 +492,31 @@ fetch_verify() {
 # exists, else anonymous). These are non-executable text (not the integrity-checked binary); the
 # sudoers is `visudo -cf`-validated before install, which catches corruption/tampering that would
 # matter. $1=repo-path $2=dest
+#
+# R-110 / R-183: PINNED TO THE AGENT VERSION BEING INSTALLED, never to a branch.
+#
+# These sixteen files are the AGENT's configs — its systemd unit, its sudoers, its guarded wrappers —
+# so the ref that is correct for them is the agent version this run is installing, which the hub has
+# vouched and whose binary sha this script verifies. It is NOT the installer's own SCRIPT_VERSION:
+# these files do not live in the installer's repo and have no relationship to its version line.
+#
+# Before this they came from `raw/branch/main`, which is a REAL SKEW and not only a publish-channel
+# defect (R-183): a fresh install fetched the vouched agent BINARY while taking its unit file and
+# sudoers from whatever `main` happened to hold — two refs, one install, and nothing compared them.
+#
+# NO FALLBACK TO A BRANCH. A vouched version whose tag is missing must fail loudly here rather than
+# quietly serving `main`, because a silent fallback is exactly the "appearance of control with none of
+# it" this change exists to remove. `agent_gates.py`'s published-version gate keeps the tag and the
+# vouched version in step, so this die is a backstop and not the primary control.
 fetch_raw() {
     local path="$1" dest="$2"
+    # Late steps (mgmt-watchdog, OOB) can run without step 5 having resolved the manifest.
+    [[ -n "$ART_AGENT_VER" ]] || resolve_artifacts
+    [[ -n "$ART_AGENT_VER" ]] || die "cannot pin $path: no agent version resolved from the hub manifest"
     local -a _auth; _git_auth_args _auth
     curl -fsS "${_auth[@]}" -o "$dest" \
-        "$GITEA_BASE/$GITEA_OWNER/$AGENT_REPO/raw/branch/main/$path" \
-        || die "raw fetch failed: $path"
+        "$GITEA_BASE/$GITEA_OWNER/$AGENT_REPO/raw/tag/v$ART_AGENT_VER/$path" \
+        || die "raw fetch failed: $path (agent tag v$ART_AGENT_VER — is that version tagged in $AGENT_REPO?)"
     [[ -s "$dest" ]] || die "raw fetch empty: $path"
 }