Record registry-submission process + start-cli/prepare.sh; capture eval P2 backlog

Refresh AGENTS Current state for the full-eval session; document the email-based
community-registry submission flow and the start-cli installer in the packaging
guide; add a ROADMAP Security & hardening section so the eval P2s survive
EVALUATION.md overwrites.

docs/guides/startos-packaging.md

@@ -28,6 +28,18 @@ npm run prettier    # prettier --write startos  (NOT enforced; see testing.md)
 Auth for `make install` is the developer key at `~/.startos/developer.key.pem`
 (private — never commit/share).
 
+## Clean-box build bootstrap (`prepare.sh`)
+
+`prepare.sh` (in `licensing-service-startos/`) installs every HOST prerequisite a
+fresh Debian/Ubuntu box needs before `make`: apt prereqs (build-essential, jq, git,
+squashfs-tools(-ng)), Node 22 (NodeSource), Docker (+ QEMU binfmt for cross-arch),
+and **start-cli** via the official installer —
+`curl -fsSL https://start9.com/start-cli/install.sh | sh` (drops the binary in
+`~/.local/bin`). Rust is **not** installed on the host; the daemon compiles inside
+the Dockerfile (`FROM rust:1.88`). Idempotent; apt-based only. Caveat: `prepare.sh`
+is a 0.3.5.x submission convention — the 0.4.x docs never mention it, so Start9's
+0.4.x build flow may not actually invoke it (confirm before relying on it).
+
 ## ALWAYS: bump the version before building
 
 Edit `startos/versions/v0.2.0.ts` — increment `version: '0.2.0:N'` and prepend a