hostwarden-os-installlisted

# OS Installation, Replacement and Boot Management Five workflows that share one disk, one boot loader and one irreversible moment. Read the gate below first, then the reference that matches what the user asked for. A new VM or container is none of them: `hostwarden-new-guest` creates it, with the guard on. ## Reading is always allowed Inspection needs none of the gate below. `efibootmgr -v`, `lsblk`, `fdisk -l`, `gpart show`, `diskutil list`, reading a boot loader's config, working out why a fresh VM will not boot — all of it runs under the guard like any other read-only work, and this skill is often invoked for exactly that. Never ask an operator to disable a safety mechanism in order to look at something. ## Boot entries are not the gate Changing an EFI boot entry destroys no data, and the guard does not block `efibootmgr` in any form. Setting `BootNext` for a one-shot test is the *safe* way to try a new OS, and needing the guard off to do it would be backwards. So boot-entry work follows `references/efi-boot.md` § Safety instead, which owns those rules. The one place boot configuration turns dangerous is ordering, not permission — pointing the firmware at a root filesystem that is not written yet, or overwriting the fallback binary before it is. `references/os-replacement.md` § Boot Configuration Safety owns that, and it applies whether or not the guard is on. ## Vendor hardware is out of scope No workflow below **writes** on a device whose only OS is the vendo