release(v1.7.20-alpha): stop auto-apply scheduler killing the service

The 3AM auto-update path called std::process::exit(0) immediately
after apply_update returned. apply_update had already spawned a 2s-
delayed systemctl restart, but exit(0) killed the runtime before that
spawned task could run — and the unit's Restart=on-failure does not
trigger on a clean exit 0, so the service stayed dead until someone
SSH'd in and started it manually (.253 hit this today).

Scheduler now returns from the task without killing the process;
apply_update's existing restart path (same one the UI's Install
Update button uses) brings the new version up cleanly.

Also hardens the ISO CI: the AIUI inclusion step now falls back to
extracting from the newest release tarball if the runner's cached
/opt/archipelago/web-ui/aiui path is missing, so a reprovisioned
runner can't silently ship a frontend tarball without AIUI. The ISO
build step also sanity-checks the binary exists before invoking the
builder.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-iso-dev.yml

@@ -74,12 +74,38 @@ jobs:
 
       - name: Include AIUI if available
         run: |
-          if [ -d "/opt/archipelago/web-ui/aiui" ] && [ -f "/opt/archipelago/web-ui/aiui/index.html" ]; then
-            mkdir -p web/dist/neode-ui/aiui
-            cp -r /opt/archipelago/web-ui/aiui/* web/dist/neode-ui/aiui/
-            echo "AIUI included from /opt/archipelago/web-ui/aiui/"
+          # AIUI (the Claude chat sidebar) lives outside the Vue build
+          # and must be copied into the frontend dist BEFORE packaging,
+          # otherwise OTA-tarball upgrades silently strip it from nodes
+          # in the field. Try in order: cached on runner, then the
+          # newest release tarball in this repo's releases/ dir as a
+          # fallback so a freshly-provisioned runner still gets AIUI.
+          AIUI_SRC=""
+          if [ -f "/opt/archipelago/web-ui/aiui/index.html" ]; then
+            AIUI_SRC="/opt/archipelago/web-ui/aiui"
+          elif [ -f "$HOME/archy/web/dist/neode-ui/aiui/index.html" ]; then
+            AIUI_SRC="$HOME/archy/web/dist/neode-ui/aiui"
           else
-            echo "WARNING: AIUI not found on build server — ISO will not include AIUI"
+            LATEST_FRONTEND=$(ls -t releases/v*/archipelago-frontend-*.tar.gz 2>/dev/null | head -1)
+            if [ -n "$LATEST_FRONTEND" ]; then
+              echo "Extracting AIUI from $LATEST_FRONTEND (runner cache miss)"
+              TMP=$(mktemp -d)
+              tar xzf "$LATEST_FRONTEND" -C "$TMP" ./aiui 2>/dev/null || true
+              if [ -f "$TMP/aiui/index.html" ]; then
+                AIUI_SRC="$TMP/aiui"
+              fi
+            fi
+          fi
+          if [ -n "$AIUI_SRC" ]; then
+            mkdir -p web/dist/neode-ui/aiui
+            cp -r "$AIUI_SRC/"* web/dist/neode-ui/aiui/
+            echo "AIUI included from $AIUI_SRC ($(du -sh web/dist/neode-ui/aiui | cut -f1))"
+          else
+            echo "FAIL: AIUI not found anywhere (runner cache + release tarballs)"
+            echo "  checked: /opt/archipelago/web-ui/aiui"
+            echo "           \$HOME/archy/web/dist/neode-ui/aiui"
+            echo "           releases/v*/archipelago-frontend-*.tar.gz"
+            exit 1
           fi
 
       - name: Configure root podman for insecure registry
@@ -93,7 +119,15 @@ jobs:
         run: |
           cd image-recipe
           export ARCHIPELAGO_BIN="$(pwd)/../core/target/release/archipelago"
-          ls -la "$ARCHIPELAGO_BIN" || echo "WARNING: binary not found"
+          if [ ! -x "$ARCHIPELAGO_BIN" ]; then
+            echo "FAIL: backend binary missing or not executable at $ARCHIPELAGO_BIN"
+            exit 1
+          fi
+          BIN_VERSION=$(strings "$ARCHIPELAGO_BIN" | grep -oE 'archipelago [0-9]+\.[0-9]+\.[0-9]+(-[a-z]+)?' | head -1 || true)
+          EXPECTED=$(grep '^version' ../core/archipelago/Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
+          echo "Binary: $ARCHIPELAGO_BIN ($(du -h "$ARCHIPELAGO_BIN" | cut -f1))"
+          echo "Embedded version string: ${BIN_VERSION:-unknown}"
+          echo "Expected version (Cargo.toml): $EXPECTED"
           sudo -E UNBUNDLED=1 DEV_SERVER=localhost BUILD_FROM_SOURCE=0 \
             ARCHIPELAGO_BIN="$ARCHIPELAGO_BIN" \
             ./build-auto-installer-iso.sh