docs: Herdr boot persistence applied and verified

/boot/config/go now restores /root/.local/bin/herdr-core from
/boot/config/herdr/herdr-core at boot, with install -m 755 since /boot is
FAT32 and carries no execute bit.

Verified without rebooting: deleted the binary, ran the go line by hand, got
it back executable and reporting hc 0.1.17, with Herdr still connected.
sh -n /boot/config/go parses cleanly. The go script was backed up to
go.bak-20261103-203916 before editing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/14-HERDR-REMOTE-MACHINES.md

@@ -96,4 +96,14 @@ install -m 755 /boot/config/herdr/herdr-core /root/.local/bin/herdr-core 2>/dev/
 
 `install -m 755` matters: `/boot` is FAT32 and does not carry the execute bit.
 
-**Status: not applied.** Pending.
+**Status: applied 2026-11-03.** The `go` script was backed up to
+`/boot/config/go.bak-20261103-203916` first.
+
+Verified without rebooting, by deleting `/root/.local/bin/herdr-core` and running
+the `go` line by hand: the binary came back `-rwxr-xr-x` and reported `hc 0.1.17`.
+Herdr stayed `connected` throughout.
+
+One note if you ever call it over a bare SSH command: `~/.local/bin` is not on
+`PATH` in a non-interactive shell on Unraid, so `herdr-core` resolves only by
+absolute path. Herdr itself always uses the absolute path, so this does not
+affect normal use.

docs/CHANGELOG.md

@@ -16,7 +16,7 @@
 ### Tooling: Unraid registered as a Herdr (hc) machine
 - **[SERVICE]** Unraid added to Herdr as the machine `unraid` (`hc` 0.1.17 on the remote). `herdr-core machine add` had been failing with `core did not start within 5 s`: `hc` puts its core socket under `XDG_RUNTIME_DIR`, which on Unraid is `/run/user/0` — a directory elogind creates and destroys per login session, so the socket disappeared the moment the session that started the core ended. The core kept running with an unlinked socket, and `core.log` stayed empty because the failure is client side.
 - **[SERVICE]** Fixed from the Mac only, via `~/.local/bin/herdr-via-unraid`, a `--via` transport that exports `XDG_RUNTIME_DIR=/var/run/herdr-rt` on every connection. Nothing on the server was changed. Uses key auth on 192.168.10.20:422 rather than Tailscale SSH, because `--via` needs a transport that asks nothing and the default tailnet ACL `check` would demand periodic browser re-auth.
-- **[SERVICE]** Reboot caveat: `/` is rootfs (RAM) and `/run` is tmpfs on Unraid, so `/root/.local/bin/herdr-core` is lost at every boot and needs `herdr-core machine update` to restore. A `/boot/config/go` entry to restore it automatically is written up but **not applied**. Detail in `docs/14-HERDR-REMOTE-MACHINES.md`.
+- **[SERVICE]** Reboot caveat: `/` is rootfs (RAM) and `/run` is tmpfs on Unraid, so `/root/.local/bin/herdr-core` is lost at every boot and needs `herdr-core machine update` to restore. A `/boot/config/go` entry now restores it at boot from `/boot/config/herdr/herdr-core` (`install -m 755`, because /boot is FAT32 and carries no execute bit). Applied 2026-11-03, with the go script backed up to `go.bak-20261103-203916` and verified by deleting the binary and running the line by hand. Detail in `docs/14-HERDR-REMOTE-MACHINES.md`.
 - Corrected the 192.168.31.0/24 note: the shim was created in the go script for a Pi-hole at 192.168.31.4, which AdGuard replaced. No such container exists and the address is silent.
 
 ---