chore(scripts): one-shot node-side companion-manifest repair script

Curl-and-pipe repair for nodes whose companion-UI manifests are stale
(no session_passthrough): fetches the four current manifests from the
public repo, installs them into /opt/archipelago/apps AND the frontend
runtime payload (which restores over apps/ at every boot), restarts,
and reports the gate probe. Long paste-blocks kept mangling in the
operator's terminal — this replaces them with one short line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/fix-companion-manifests.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# One-shot node-side repair: pull the current companion-UI manifests
+# (session_passthrough on the gated ports) from the public repo, install
+# them into every location the daemon reads, restart, and report.
+#
+# Run on a node:
+#   curl -sf https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/scripts/fix-companion-manifests.sh | bash
+#
+# Idempotent and safe to re-run. Needs passwordless sudo (fleet default).
+set -u
+
+BASE="https://source.archipelago-foundation.org/lfg2025/archy/raw/branch/main/apps"
+RUNTIME="/opt/archipelago/web-ui/archipelago-runtime/apps"
+updated=0
+
+for app in lnd-ui bitcoin-ui electrs-ui fips-ui; do
+    tmp="/tmp/${app}-manifest.yml"
+    if ! curl -sf --max-time 30 "$BASE/$app/manifest.yml" -o "$tmp"; then
+        echo "✗ $app: download failed"; continue
+    fi
+    if ! grep -q session_passthrough "$tmp"; then
+        echo "✗ $app: fetched file missing session_passthrough — refusing"; continue
+    fi
+    sudo cp "$tmp" "/opt/archipelago/apps/$app/manifest.yml" || { echo "✗ $app: install failed"; continue; }
+    # The frontend's runtime payload is restored over /opt/archipelago/apps at
+    # every daemon boot on nodes that carry it — update it too or the fix
+    # reverts on the next restart.
+    if [ -d "$RUNTIME/$app" ]; then
+        sudo cp "$tmp" "$RUNTIME/$app/manifest.yml"
+    fi
+    echo "✓ $app updated"
+    updated=$((updated + 1))
+done
+
+if [ "$updated" -eq 0 ]; then
+    echo "Nothing updated — not restarting."
+    exit 1
+fi
+
+sudo systemctl restart archipelago
+echo "Daemon restarted; waiting for the gate…"
+sleep 15
+ip=$(hostname -I | tr ' ' '\n' | grep '^100\.' | head -1)
+code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 "http://$ip:18083/" 2>/dev/null)
+echo "ext :18083 -> $code  (401 = gate holds the port: CORRECT)"