feat(09-07): update archi-dev-box to BotFights 1.2.1 via signed catalog + demo checklist

Real user path: package.check-updates RPC (catalog refresh, release-root signature
verified) then package.update RPC (id=botfights) — no hand-placed container. Verified:
image :1.2.1 healthy, ARENA_UPSTREAM_URL set, JWT_SECRET delivered as a podman secret
(0600, 64 hex chars, no plaintext env value), local /api/bots matches the arena's 104+15
fighters (thin-client proxy confirmed), local botfights.db byte-identical pre/post
(367144960 bytes, mtime 1782916151 — 115 bots/102,440 fights preserved untouched),
survives podman restart, arena health unaffected. x250-dev unreachable this session
(SSH timeout) — dev-pair rule satisfied on archi-dev-box only, recorded in the checklist.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.planning/phases/09-botfights-platform-upgrade/09-DEMO-CHECKLIST.md

@@ -0,0 +1,114 @@
+# BotFights Demo-Day Run Sheet (2026-07-31)
+
+**Host:** archi-dev-box (this machine), BotFights 1.2.1 installed via the signed catalog,
+proxying to the shared public arena. `x250-dev` was unreachable this session (SSH
+connect timeout on Tailscale IP 100.72.136.6) — the dev-pair rule is satisfied on
+archi-dev-box only; repeat Task 1's steps there if it comes back online before the demo.
+
+## URLs
+
+| What | URL |
+|---|---|
+| **Canonical public arena** (the shared match/fighter state) | https://botfights.archipelago-foundation.org |
+| **Node UI on archi-dev-box** (what you demo from — same fighters, thin client) | http://localhost:9100/ (or `http://192.168.63.240:9100/` from another device on the LAN) |
+| **Unified AI bot-setup prompt** (hand this URL alone to a cloud agent) | https://botfights.archipelago-foundation.org/api/docs/prompt |
+| Local health check | http://localhost:9100/api/health |
+| Arena health check | https://botfights.archipelago-foundation.org/api/health |
+
+## What's already verified (automated, this session)
+
+- `podman inspect botfights` → image `146.59.87.168:3000/lfg2025/botfights:1.2.1`, container healthy.
+- `ARENA_UPSTREAM_URL=https://botfights.archipelago-foundation.org` present in the container env.
+- `JWT_SECRET` delivered as a podman secret (`--secret archy-env-botfights-jwt_secret,type=env,target=JWT_SECRET`),
+  masked in `podman inspect`, backed by `/var/lib/archipelago/secrets/botfights-jwt-secret`
+  (mode `600`, 64 hex chars) — **no plaintext `JWT_SECRET=` in the container env.**
+- `curl http://localhost:9100/api/bots` returns **104** fighters (default filter), matching
+  `curl https://botfights.archipelago-foundation.org/api/bots` exactly (104). `?type=classic`
+  on both returns 15 — full parity, thin-client proxy mode confirmed live.
+- `curl http://localhost:9100/api/docs/prompt` returns the unified prompt with the arena's
+  own hostname substituted (5 occurrences of `botfights.archipelago-foundation.org`).
+- `/var/lib/archipelago/botfights/botfights.db` untouched: **367144960 bytes**, mtime
+  **1782916151**, byte-identical before/after the update (115 bots / 102,440 fights preserved
+  on disk, no longer read now that the app is in proxy mode).
+- Survived a real `podman restart botfights`: came back healthy, same env, same live fighter
+  count (104) afterward.
+- Arena itself (`https://botfights.archipelago-foundation.org/api/health`) still answers `ok`
+  after all of the above — nothing broke on the arena side.
+
+## Click path for demo day
+
+### 1. Real nostr signer login (D-01)
+
+1. Open http://localhost:9100/ in a browser with a NIP-07 extension installed (nos2x or Alby).
+2. Click **Sign In**. Approve the signature request in the extension popup.
+   - Expect: you are signed in, your bot/profile appears. The extension prompts you to *sign
+     an event* — at no point are you asked for a private key.
+3. Reload the page.
+   - Expect: still signed in, **no second signature prompt** (session persisted via JWT).
+4. Optional, higher-value if time allows: repeat from an Android phone with Amber (NIP-55)
+   against the same URL (use the LAN URL `http://192.168.63.240:9100/` from the phone, not
+   `localhost`).
+
+**Something's wrong if:** a spinner never resolves, login silently fails, or you're asked to
+paste/select a private key anywhere.
+
+### 2. Shared arena / cross-node fighter visibility (D-03)
+
+1. Open https://botfights.archipelago-foundation.org in a second tab, side-by-side with
+   http://localhost:9100/.
+2. Confirm the fighter list / leaderboard is the same in both tabs. Pick a fighter you can
+   see only because it's an arena-side registration and confirm it also shows up on the
+   node's local UI.
+3. Start or join a fight from either tab and confirm rounds appear live, incrementally — not
+   all at once when the fight ends (SSE streaming, already verified working through the
+   canonical HTTPS path in 09-05).
+
+**Something's wrong if:** the two tabs show different fighter counts/lists, or a live fight's
+rounds only appear in a single batch at the end.
+
+### 3. Cloud "openclaw" bot from the prompt alone (D-02)
+
+1. Hand your cloud agent **only** this URL, nothing else:
+   `https://botfights.archipelago-foundation.org/api/docs/prompt`
+   Instruction: "set yourself up as a BotFights bot using this."
+2. Expect the agent, from that document alone, to:
+   - `POST /api/bots` and receive an `id` + `secret` (no nostr identity needed for a bot).
+   - Authenticate and poll for challenges (`GET /api/fights/poll`, verified working since
+     09-05's route-order fix) — or stand up a webhook, if it chooses that mode.
+   - Join the queue and fight.
+   - Have that fight show up in the BotFights UI on archi-dev-box (http://localhost:9100/).
+3. If the agent gets stuck, **quote the exact question it could not answer from the prompt**
+   — that's the single most useful finding this step can produce, more useful than "it didn't
+   work."
+
+## Fallback: arena unreachable on the day
+
+If https://botfights.archipelago-foundation.org is down or unreachable from archi-dev-box,
+switch this node back to a fully standalone, node-local arena by removing the
+`ARENA_UPSTREAM_URL` env var and recreating the container:
+
+```bash
+# On archi-dev-box, as a user with podman/sudo access to the container:
+sudo sed -i '/ARENA_UPSTREAM_URL=/d' /opt/archipelago/apps/botfights/manifest.yml 2>/dev/null || true
+# Preferred: use the UI's per-app "Edit config" / re-install path so the orchestrator
+# regenerates the container from the catalog-overlaid manifest with the var removed,
+# rather than hand-editing the container. If using the RPC directly:
+#   package.update with id=botfights after removing ARENA_UPSTREAM_URL from the
+#   effective environment (catalog-covered apps ignore raw disk manifest edits — see
+#   09-07-PLAN.md read_first notes on catalog overlay supremacy).
+```
+
+The node's own local database (`/var/lib/archipelago/botfights/botfights.db`, 115 bots /
+102,440 fights) is intact on disk and untouched — switching back to standalone mode makes
+it visible/writable again immediately, no data loss, no migration needed. `/api/health`
+stays local and answers `ok` regardless of arena state; only `/api/bots` and fight data
+degrade if the arena goes down while still in proxy mode.
+
+## Known limitation this session
+
+- `x250-dev` (Tailscale 100.72.136.6) was unreachable — SSH connection timed out. The
+  dev-pair verification rule (deploy/verify on both archi-dev-box and x250-dev before any
+  catalog-adjacent change) is satisfied on archi-dev-box only for this plan. If x250-dev
+  comes back online before the demo, repeat this plan's Task 1 steps there (catalog refresh
+  via `package.check-updates`, then `package.update` with `id: botfights`) and record the
+  outcome.