fix(iso): make baseline apps work on a fresh install with no internet

Fresh offline installs came up without fedimint-clientd and filebrowser
(they only appeared after connecting internet). Three root causes:

- archipelago-load-images.service ran 'podman load' as root, but every
  container runs rootless as archipelago — bundled images landed in
  root's storage where the rootless runtime can't see them, so all
  container creation silently depended on registry pulls. The loader now
  loads into the archipelago user's storage (with linger + runtime-dir
  wait + system migrate).
- The unbundled ISO bundled only filebrowser.tar; fmcd (fedimint-clientd)
  is a baseline first-boot app too and is now part of the unbundled core
  bundle.
- first-boot's pull_with_fallback always hit the network; it now uses an
  already-loaded local image first and skips the pull entirely.

Also: fedimint-clientd added to the UI's hardcoded curated-app fallback
list (it was missing when all catalog fetches fail offline), plus its
INSTALLED_ALIASES entry, and the stale fmcd bundling comment in
image-versions.sh corrected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/first-boot-containers.sh

@@ -112,6 +112,13 @@ if [ -f "$UNBUNDLED_MARKER" ]; then
     # Helper: pull image with fallback registry
     pull_with_fallback() {
         local img="$1"
+        # Pre-bundled ISO images are already loaded into the rootless
+        # storage by archipelago-load-images.service — use them and skip
+        # the network entirely (fresh installs must work offline).
+        if $DOCKER image exists "$img" 2>/dev/null; then
+            log "  Image already present locally: $img"
+            return 0
+        fi
         log "  Pulling $img..."
         if $DOCKER pull "$img" 2>>"$LOG"; then
             return 0