fix: v1.3.3 — firmware, fedimint perms, GRUB fallback, data dirs, Rust warnings

- Add firmware-linux-nonfree to ISO (fixes missing Realtek NIC firmware)
- Pre-create nbxplorer/Main and btcpay/Main data directories
- Fix fedimint data dir permissions (chmod 775 for non-root container)
- GRUB GFX fallback: gfxpayload=keep + console fallback for incompatible hardware
- Kill stale Chromium before kiosk restart (prevents duplicate processes)
- Suppress Rust warnings: #[allow(dead_code)] on run_boot_reconciliation,
  #[allow(unused_assignments)] on history_dirty
- Version bump to 1.3.3

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/first-boot-containers.sh

@@ -649,7 +649,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q archy-nbxplorer; the
     $DOCKER start archy-nbxplorer 2>/dev/null || true
   else
     log "Creating NBXplorer..."
-    mkdir -p /var/lib/archipelago/nbxplorer
+    mkdir -p /var/lib/archipelago/nbxplorer/Main
     $DOCKER run -d --name archy-nbxplorer --restart unless-stopped \
       --health-cmd="curl -sf http://localhost:32838/ || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
       --memory=$(mem_limit archy-nbxplorer) --network archy-net --network-alias archy-nbxplorer \
@@ -667,7 +667,7 @@ track_container "archy-nbxplorer"
 
 if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q btcpay-server; then
   log "Creating BTCPay Server..."
-  mkdir -p /var/lib/archipelago/btcpay
+  mkdir -p /var/lib/archipelago/btcpay/Main
   $DOCKER run -d --name btcpay-server --restart unless-stopped \
     --health-cmd="curl -sf http://localhost:49392/ || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
     --memory=$(mem_limit btcpay-server) --network archy-net --network-alias btcpay-server \
@@ -739,6 +739,7 @@ track_container "lnd"
 if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q fedimint; then
   log "Creating Fedimint..."
   mkdir -p /var/lib/archipelago/fedimint
+  chmod 775 /var/lib/archipelago/fedimint  # fedimint container runs as non-root
   $DOCKER run -d --name fedimint --restart unless-stopped \
     --health-cmd="curl -sf http://localhost:8174/ || exit 1" --health-interval=120s --health-timeout=5s --health-retries=3 \
     --memory=$(mem_limit fedimint) --network archy-net --network-alias fedimint \