host-install: add --skip-provision (agent-only install/verify path)

Install + configure + verify the agent (incl. golden fetch+verify) without
provisioning a guest — for re-installing/upgrading the agent on a host with live
guests, and the agent-only live test. Adds step_verify_agent (binary + non-root
service active + --selftest=hub).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/CHANGELOG.md

@@ -15,6 +15,10 @@ hub-vouched artifact manifest** before installing/using it. BUNDLE slice; pairs
   `0755 /usr/local/bin/felhom-agent`; ensures the non-root `felhom-agent` system user; installs the
   canonical sudoers (`0440`, `visudo -cf`-validated) + systemd unit; `daemon-reload` + enable. Idempotent:
   same version already installed + service active → skip.
+- **`--skip-provision`:** install + configure + verify the agent (incl. golden fetch+verify) but do NOT
+  provision a guest — the agent-only path for re-installing/upgrading the agent on a host that already
+  has live guests. Adds an agent-only `step_verify_agent` (binary + non-root service active + a
+  `--selftest=hub` collect-report).
 - **New step `7/8 golden`:** local auto-discovery stays the default/fallback; otherwise fetches
   `/api/packages/admin/generic/felhom-golden/<ver>/golden.tar.zst`, **verifies sha256**, and imports it
   into the archive storage's dump dir for the restore. `--force-gitea-golden` forces the Gitea path.