feat(09-07): update archi-dev-box to BotFights 1.2.1 via signed catalog + demo checklist
Real user path: package.check-updates RPC (catalog refresh, release-root signature
verified) then package.update RPC (id=botfights) — no hand-placed container. Verified:
image :1.2.1 healthy, ARENA_UPSTREAM_URL set, JWT_SECRET delivered as a podman secret
(0600, 64 hex chars, no plaintext env value), local /api/bots matches the arena's 104+15
fighters (thin-client proxy confirmed), local botfights.db byte-identical pre/post
(367144960 bytes, mtime 1782916151 — 115 bots/102,440 fights preserved untouched),
survives podman restart, arena health unaffected. x250-dev unreachable this session
(SSH timeout) — dev-pair rule satisfied on archi-dev-box only, recorded in the checklist.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
