docs: GL-8 wrap — runbook F3/F6 notes, findings FIXED, REPORT, decision log

day0-install: F3 (no --allow-new-leaf on a populated BYO host) + F6 (:53 must
be free, refusal + remediation). GO-LIVE-PACKAGE + DRILL-GL6 ledger flip
F1/F3/F6 -> FIXED v1.12.0; GL-7 unblocked; F2/F7 stay open. CONTEXT + REPORT.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,17 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-08 — TASK GL-8 SHIPPED: BYO coexistence hardening (host-install v1.12.0, `18a556a5`)** —
+  the GL-6 findings F3/F6/F1. **F3:** the populated-host leaf guard fires only when a `felhom_guests`
+  guest exists (not `pct list`) → a fresh byo install on a host running only the OWNER's guests needs
+  no `--allow-new-leaf`; the pin protection for real Felhom guests is unchanged. **F6:** byo preflight
+  REFUSES a foreign process on `:53` with remediation and mutates NOTHING (Viktor's ruling: refuse+
+  instruct only — the dnsmasq analog of the break-glass no-touch rule; appliance untouched). **F1:**
+  uninstall purges the config `.bak*` siblings (a GL-6 residue held a live hub api_key). F6
+  live-proven on felhom-pve (byo preflight refuses at :53 — the exact GL-6 scenario, read-only die).
+  Harness 36/36 (+GL8-F3/F6/F1 static, GL8-F1b behavioural, GL8-F6 live) + red-proofs RP-F3/F6/F1;
+  GL-2/GL-4 regression green; shellcheck clean. Shipped BEFORE GL-7 so Peti's command needs no
+  workaround. **F2/F7 remain open (non-blocking). NEXT: GL-7.**
 - **2026-07-08 — TASK GL-5 SHIPPED: DR bring-up bind overrides (agent v0.75.0, LIVE + scratch-DR
   validated)** — go-live G8; docs-only here (GO-LIVE-PACKAGE G8/G6/G1 flips + decision log; the
   code + full report live in felhom-agent `b3446213`). Guest-loss DR restore WORKS now: the two