fix(iso): fail builds on missing VPN binaries, skip units cleanly, invalidate stale rootfs cache

v1.7.104 shipped ISOs whose units crash-looped (nostr-relay 3s loop,
archipelago-diag 203/EXEC) because build-time extraction failures were mere
warnings and the cached rootfs never tracked its recipe:

- hash the rootfs-defining region of the build script and rebuild when it
  changes (stale cache shipped ISOs without wpasupplicant/iw/rfkill)
- refuse to build without nvpn / nostr-rs-relay unless
  ALLOW_MISSING_VPN_BINARIES=1
- ConditionPathExists on nostr-relay/nostr-vpn/diag units so a stripped
  image skips them instead of crash-looping
- post-install test: every enabled archipelago*/nostr* unit must have an
  existing ExecStart payload

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/run-post-install-tests.sh

@@ -103,6 +103,23 @@ for f in /usr/local/bin/archipelago \
   fi
 done
 
+# 1.1b — Every enabled archipelago/nostr unit must have an existing ExecStart
+# payload. v1.7.104 shipped nostr-relay.service without its binary (3s
+# crash-loop forever) and archipelago-diag.service without its script
+# (203/EXEC) — catch that class of ISO defect on first boot, by generic rule.
+for unit in /etc/systemd/system/archipelago*.service /etc/systemd/system/nostr*.service; do
+  [ -f "$unit" ] || continue
+  systemctl is-enabled "$(basename "$unit")" >/dev/null 2>&1 || continue
+  exec_bin=$(grep -m1 '^ExecStart=' "$unit" | sed 's/^ExecStart=[-+@!:]*//' | awk '{print $1}')
+  case "$exec_bin" in
+    /*) if [ -e "$exec_bin" ]; then
+          pass "Unit payload exists: $(basename "$unit") → $exec_bin"
+        else
+          fail "Unit payload missing" "$(basename "$unit") → $exec_bin"
+        fi ;;
+  esac
+done
+
 # 1.2 — Critical services active
 for svc in archipelago nginx; do
   if systemctl is-active "$svc" >/dev/null 2>&1; then