perf(async): remove blocking std::process::Command from async paths

Every production process spawn reachable from a tokio worker now uses
tokio::process: the install path's podman-port probe, the dependencies
disk check, factory-reset restart, config host-IP detection, the
orchestrator's host-facts helpers (resolve_dynamic_env and its call
sites made async to carry it through), and AutoRuntime's podman/docker
probes.

The FIPS transport probe is the special case: is_available() is a sync
trait method called from async route(), so instead of blocking ~50ms
on systemctl per stale-cache hit it now serves the cached value and
refreshes on a background thread (stale-while-revalidate) — bounded
staleness, zero stalled workers.

§C of the 1.8.0 hardening plan; container/transport/config/package
suites green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/1.8.0-RELEASE-HARDENING-PLAN.md

@@ -114,11 +114,16 @@ modules; production request/boot paths are essentially panic-free. The real risk
       sweep (`scheduler.rs`), block-header cache (`mesh/mod.rs`), 7× peer-transport badge
       (`sync.rs` + `content.rs`). Federation tombstone/untombstone upgraded to hard errors
       (see §I). Install-log line write left fire-and-forget with an explanatory comment.
-- [ ] 🟠 **Remove blocking `std::process::Command` from async handlers.**
-      `install.rs:2222` `published_host_port` (sync podman on the install path),
-      `dependencies.rs:316` (`df`), `system/handlers.rs:578` (`sudo`), `transport/fips.rs:50`
-      (`systemctl`) stall tokio workers under load. Convert to `tokio::process` or
-      `spawn_blocking`. Only 8 files use `std::process::Command` — bounded.
+- [x] 🟠 **Remove blocking `std::process::Command` from async handlers.** DONE 2026-07-03:
+      converted to `tokio::process` — `published_host_port` (install), `detect_disk_gb`
+      (dependencies), factory-reset restart (system/handlers), `config.rs detect_host_ip`,
+      the orchestrator host-facts helpers (`detect_host_ip/mdns/disk_gb`, `bitcoin_host`,
+      `resolve_dynamic_env` now async through all 6 call sites), and `AutoRuntime::new`
+      probes. `transport/fips.rs is_available()` (sync trait method on the async route path)
+      now serves the cached value and refreshes via a background thread (stale-while-
+      revalidate) instead of blocking on systemctl. `image_verifier.rs` cosign sites have no
+      callers yet — handled with the §A cosign item. Tests: container 155 / transport 29 /
+      config 29 / package 46 all green.
 - [ ] 🟡 **Restrict Bitcoin RPC exposure.** `bootstrap.rs:409` writes
       `rpcallowip=0.0.0.0/0`. Scope to the container subnet / `127.0.0.1`.
 - [ ] 🟡 **Move generated secrets from env to file mounts.** `manifest.rs:1208-1226`
@@ -159,9 +164,11 @@ The real issues are the app-bridge origin model and a bloated bundle.
       (precached by the service worker → blocks PWA install), plus ~18 MB of ~1 MB full-screen
       JPEGs. Convert backgrounds to WebP/AVIF at responsive sizes, lazy/stream the intro video,
       and exclude video/audio from the Workbox precache. Biggest, easiest perf win.
-- [ ] 🟢 **DOMPurify the `Server.vue` QR SVG** (`:283/:295` render `v-html` unsanitized while
-      `TwoFactorSection.vue` sanitizes the analogous SVG); guard the unguarded `pollInterval`
-      (`Mesh.vue:391`); surface silent data-fetch failures (`curatedApps.ts:58/71`).
+- [x] 🟢 **DOMPurify the `Server.vue` QR SVG / guard `Mesh.vue` pollInterval / surface
+      `curatedApps.ts` fetch failures.** DONE 2026-07-03: WireGuard peer QR now sanitized with
+      the same `USE_PROFILES: {svg}` call as TwoFactorSection; Mesh poll interval guarded +
+      nulled on unmount; catalog fetch failures log per-URL console.warn incl. the
+      all-sources-failed fallback. Bundle-verified.
 
 ---