fix(mesh): radio tools ship via OTA + ISO; transport flag gated on daemon support

v1.7.117 broke Reticulum mesh on OTA-only fleet nodes two ways: the
update swaps only the backend binary and frontend tarball, so nodes
kept a stale archy-reticulum-daemon whose argparse exits on the new
--enable-transport flag (mesh session died on every spawn — confirmed
on framework-pt), and they never had archy-rnodeconf at all, so the
in-app Flash LoRa flow failed with a bare "No such file or directory".

Four-part fix:
- The Rust supervisor probes `daemon --help` and only passes
  --enable-transport when the daemon advertises it; unsupported daemons
  run edge-only exactly as pre-1.7.117 (tested against stub daemons
  both ways + missing-binary fail-safe).
- Both PyInstaller tools ride the frontend tarball's runtime payload
  (radio-tools/) and bootstrap.rs promotes them to /usr/local/bin on
  startup when bytes differ — the first OTA path that ever updates
  them. create-release.sh now rebuilds them every release and the
  manifest script hard-fails if they're missing.
- The ISO bundles archy-rnodeconf alongside the daemon (it never did).
- Flash LoRa reports "tool not installed — update the node" instead of
  the bare spawn error when rnodeconf is absent everywhere.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/create-release-manifest.sh

@@ -115,6 +115,23 @@ if [ -z "$FRONTEND_ARCHIVE" ]; then
             cp "$PROJECT_ROOT/image-recipe/configs/nginx-archipelago.conf" \
                 "$RUNTIME_DIR/image-recipe/configs/nginx-archipelago.conf"
         fi
+        # Packaged radio tools ride the runtime payload: OTA-only nodes never
+        # get them any other way — the v1.7.117 rollout left fleet nodes with
+        # a stale archy-reticulum-daemon (exits on the new --enable-transport
+        # flag → mesh dead) and no archy-rnodeconf at all (Flash LoRa fails
+        # with "No such file or directory"). bootstrap.rs promotes these to
+        # /usr/local/bin on first startup after the update.
+        for tool in archy-reticulum-daemon archy-rnodeconf; do
+            if [ -f "$PROJECT_ROOT/reticulum-daemon/dist/$tool" ]; then
+                mkdir -p "$RUNTIME_DIR/radio-tools"
+                echo "  Including radio tool $tool"
+                cp "$PROJECT_ROOT/reticulum-daemon/dist/$tool" "$RUNTIME_DIR/radio-tools/$tool"
+            else
+                echo "  ERROR: reticulum-daemon/dist/$tool missing — run reticulum-daemon/build.sh first" >&2
+                rm -rf "$STAGING_DIR"
+                exit 1
+            fi
+        done
         rm -rf "$RUNTIME_DIR/scripts/resilience/reports"
         find "$RUNTIME_DIR" -type d -name '__pycache__' -prune -exec rm -rf {} +
         find "$RUNTIME_DIR" -type f \( -name '*.bak' -o -name '*.bak-*' -o -name '._*' -o -name '*.log' -o -name '*.pyc' \) -delete

scripts/create-release.sh

@@ -167,6 +167,16 @@ if ! grep -rqo "${VERSION}" "$PROJECT_ROOT"/web/dist/neode-ui/assets/*.js; then
     exit 1
 fi
 
+echo "[4b/8] Building packaged radio tools (archy-reticulum-daemon, archy-rnodeconf)..."
+# These ride the frontend tarball's runtime payload (radio-tools/) and are
+# promoted to /usr/local/bin by bootstrap.rs — the ONLY path that updates them
+# on OTA-only nodes. Stale-dist releases re-broke fleet mesh once (v1.7.117),
+# so always rebuild here; the manifest script hard-fails if they're missing.
+(cd "$PROJECT_ROOT/reticulum-daemon" && ./build.sh) || {
+    echo "Error: reticulum-daemon/build.sh failed — radio tools are release-critical" >&2
+    exit 1
+}
+
 echo "[5/8] Validating curated changelog..."
 
 CHANGELOG_FILE="$PROJECT_ROOT/CHANGELOG.md"