fix(kiosk): track /etc/asound.conf in image-recipe and sync it on deploy

Routes ALSA's "default" device through PulseAudio/PipeWire. Was a manual,
untracked fix living only on archy-x250-exp — a reprovision or fresh image
would silently lose it, same failure mode that already bit the GPU-flags
and CPUQuota fixes. Wired into deploy-to-target.sh (both the primary --live
path and the .198/.253 secondary-copy path) and deploy-tailscale.sh, mirroring
the existing 99-mesh-radio.rules udev sync pattern (diff-check, copy if changed).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/deploy-tailscale.sh

@@ -425,6 +425,22 @@ deploy_node() {
         ' 2>/dev/null || true
     fi
 
+    # ── Deploy ALSA default-device config ────────────────────────────
+    ASOUND_CONF="$PROJECT_DIR/image-recipe/configs/asound.conf"
+    if [ -f "$ASOUND_CONF" ]; then
+        step "Deploying ALSA default-device config"
+        scp $SSH_OPTS "$ASOUND_CONF" "$TARGET:/tmp/asound.conf" 2>/dev/null || true
+        ssh $SSH_OPTS "$TARGET" '
+            if ! diff -q /tmp/asound.conf /etc/asound.conf >/dev/null 2>&1; then
+                sudo cp /tmp/asound.conf /etc/asound.conf
+                echo "   Installed"
+            else
+                echo "   Unchanged"
+            fi
+            rm -f /tmp/asound.conf
+        ' 2>/dev/null || true
+    fi
+
     # ── Step 18: NTP + swap ──────────────────────────────────────────
     step "Ensuring NTP + swap"
     ssh $SSH_OPTS "$TARGET" '