feat(mesh): ship archy-rnodeconf on every node, wire daemon tools into deploy

RNS's own rnodeconf utility (frequency/bandwidth/spreading-factor/coding-rate
read+write, firmware signature verification, board bootstrap) has been the
one tool that reliably diagnoses real RNode hardware — it's what finally
proved two live nodes were silently running at different spreading factors
(SF5 vs SF10, invisible from any of our own probe/logging code, and the
actual reason two correctly-flashed radios could detect each other's RF but
never decode a packet). Every node should have it, not just whichever one an
agent happened to build a throwaway venv on to debug a specific incident.

- reticulum-daemon/build.sh: also PyInstaller-package archy-rnodeconf
  alongside the existing archy-reticulum-daemon, same --collect-submodules/
  -d noarchive flags (same RNS.Interfaces __all__-glob requirement applies).
- scripts/deploy-to-target.sh: actually wire both packaged binaries into the
  live deploy path (neither was wired in before — a pre-existing gap noted
  in docs/RETICULUM-TRANSPORT-PROGRESS.md; this is why reticulum-daemon
  previously only worked via manual dev-venv setup on rsync-deployed nodes,
  not the ISO-imaged ones). Non-fatal on build/deploy failure — archipelago
  already falls back to its dev-venv path if the packaged binary is absent.
  Also installs the missing `python3.<minor>-venv` package when needed
  (same "ensurepip not available" gap hit manually twice this session).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/deploy-to-target.sh

@@ -257,6 +257,13 @@ ssh $SSH_OPTS "$TARGET_HOST" '
   NEED_INSTALL=""
   command -v rsync >/dev/null 2>&1 || NEED_INSTALL="$NEED_INSTALL rsync"
   command -v python3 >/dev/null 2>&1 || NEED_INSTALL="$NEED_INSTALL python3"
+  # python3 -m venv exists but cannot bootstrap pip without the matching
+  # <major>.<minor>-venv package on Debian — needed for reticulum-daemon/
+  # build.sh (archy-reticulum-daemon / archy-rnodeconf packaging).
+  if command -v python3 >/dev/null 2>&1 && ! python3 -c "import ensurepip" >/dev/null 2>&1; then
+    PYVER=$(python3 -c "import sys; print(f\"{sys.version_info.major}.{sys.version_info.minor}\")")
+    NEED_INSTALL="$NEED_INSTALL python3.${PYVER#*.}-venv"
+  fi
   if ! command -v node >/dev/null 2>&1 || ! command -v npm >/dev/null 2>&1; then
     echo "   Node.js/npm not found — installing..."
     curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - 2>&1 | tail -3
@@ -585,6 +592,20 @@ else
     echo "   ⚠️  Rust not installed on target, skipping backend build"
 fi
 
+# reticulum-daemon tools (archy-reticulum-daemon, archy-rnodeconf) — skip with
+# --frontend-only. Non-fatal on failure: these are supplementary mesh/radio
+# tools, not required for the rest of the deploy to succeed, and build.sh
+# handles its own venv/pip setup so a first run here is slower than later ones.
+if [ "$FRONTEND_ONLY" = true ]; then
+    echo "   Skipping reticulum-daemon tools build (--frontend-only)"
+else
+    progress "Building reticulum-daemon tools (archy-reticulum-daemon, archy-rnodeconf)"
+    section_start
+    ssh $SSH_OPTS "$TARGET_HOST" "cd $TARGET_DIR/reticulum-daemon && ./build.sh 2>&1" | sed 's/^/   /' \
+        || echo "   ⚠️  reticulum-daemon tools build failed — continuing without updating them"
+    section_end
+fi
+
 if [ "$LIVE" = true ]; then
 
     # Create rollback backup before deploying
@@ -608,6 +629,26 @@ if [ "$LIVE" = true ]; then
         ssh $SSH_OPTS "$TARGET_HOST" "sudo cp $TARGET_DIR/core/target/release/archipelago /usr/local/bin/"
     fi
 
+    # Deploy reticulum-daemon tools (archy-reticulum-daemon, archy-rnodeconf) —
+    # skip with --frontend-only. Non-fatal: archipelago falls back to its dev
+    # venv path (ARCHY_RETICULUM_DAEMON_PY/_SCRIPT) if the packaged binary
+    # isn't present, so a missing/failed build here degrades rather than
+    # breaks mesh. archipelago is already stopped from the backend-binary
+    # step above, so this is a clean window to swap both binaries.
+    if [ "$FRONTEND_ONLY" = true ]; then
+        echo "   Skipping reticulum-daemon tools deploy (--frontend-only)"
+    else
+        progress "Deploying reticulum-daemon tools"
+        for tool in archy-reticulum-daemon archy-rnodeconf; do
+            if ssh $SSH_OPTS "$TARGET_HOST" "[ -f $TARGET_DIR/reticulum-daemon/dist/$tool ]" 2>/dev/null; then
+                ssh $SSH_OPTS "$TARGET_HOST" "sudo cp $TARGET_DIR/reticulum-daemon/dist/$tool /usr/local/bin/ && sudo chmod +x /usr/local/bin/$tool"
+                echo "   $tool deployed"
+            else
+                echo "   ⚠️  $tool not built — leaving existing /usr/local/bin/$tool (if any) in place"
+            fi
+        done
+    fi
+
     # Deploy frontend (preserve aiui/ and claude-login.html — they are NOT part of the neode-ui build)
     progress "Deploying frontend"
     ssh $SSH_OPTS "$TARGET_HOST" "sudo find /opt/archipelago/web-ui -mindepth 1 -maxdepth 1 ! -name 'aiui' ! -name 'claude-login.html' -exec rm -rf {} +"