chore(release): archive ISO build recipes, tarball-only releases

Releases no longer ship as bootable ISOs. Archipelago updates are
distributed as the backend binary plus a frontend tarball referenced by
releases/manifest.json. Nodes OTA-update via scripts/self-update.sh.

Filebrowser and AIUI remain bundled inside the frontend tarball and
deployed atomically, verified present in v1.7.43-alpha release artifact
(189 AIUI files, filebrowser-client bundle).

Archived under image-recipe/_archived/ (resurrectable if ISO distribution
is reintroduced):
  - build-auto-installer-iso.sh
  - build-unbundled-iso.sh
  - test-iso-qemu.sh
  - scripts/convert-iso-to-disk.sh
  - BUILD-ISO-STATUS.md, ISO-BUILD-CHECKLIST.md
  - branding/isohdpfx.bin
  - .gitea/workflows/build-iso-dev.yml

Updated release process docs to drop ISO references:
  - scripts/create-release.sh (next-steps text)
  - docs/BETA-RELEASE-CHECKLIST.md
  - docs/hotfix-process.md
  - README.md

README.md

@@ -101,14 +101,20 @@ npm run build      # Production build → web/dist/neode-ui/
 ./scripts/deploy-to-target.sh --both   # Deploy to both LAN servers
 ```
 
-### Build ISO
+### Release (tarball-only)
+
+Releases ship as a backend binary and a frontend tarball referenced by
+`releases/manifest.json`. Nodes OTA-update via `scripts/self-update.sh`.
 
 ```bash
-ssh archipelago@<server>
-cd ~/archy/image-recipe
-sudo ./build-auto-installer-iso.sh
+./scripts/create-release.sh 1.2.3
+git push gitea-local main --tags
+git push gitea-vps2 main --tags
 ```
 
+ISO builds are archived under `image-recipe/_archived/` and not part of the
+release deliverable.
+
 ## Architecture
 
 ```

docs/BETA-RELEASE-CHECKLIST.md

@@ -20,7 +20,6 @@
 - [ ] `core/security/src/secrets_manager.rs` — encryption + rotation
 - [ ] `neode-ui/src/views/Marketplace.vue` — all app entries with pinned image versions
 - [ ] `neode-ui/src/api/websocket.ts` — heartbeat + reconnection
-- [ ] `image-recipe/build-auto-installer-iso.sh` — all container images captured
 - [ ] `image-recipe/configs/nginx-archipelago.conf` — all app proxies + path traversal blocks
 - [ ] All app icons present in `neode-ui/public/assets/img/app-icons/`
 

docs/hotfix-process.md

@@ -28,9 +28,8 @@ For critical bugs discovered after v1.0.0 release.
 ### 3. Release
 - Merge hotfix branch to `main`
 - Tag: `v1.0.1` (increment patch version)
-- Build ISO if needed: `sudo ./image-recipe/build-auto-installer-iso.sh`
-- Update release manifest for OTA updates
-- Copy ISO to FileBrowser Builds folder
+- Update release manifest for OTA updates (`releases/manifest.json`)
+- Push to both Gitea mirrors so nodes can pull via `self-update.sh`
 
 ### 4. Communicate
 - Update RELEASE-NOTES with hotfix details
@@ -45,6 +44,6 @@ For critical bugs discovered after v1.0.0 release.
 ## Rollback
 
 If a hotfix causes regressions:
-1. OTA system supports rollback to previous version
-2. Users can reflash with previous ISO (app data preserved on separate partition)
+1. OTA system supports rollback to previous version (`scripts/self-update.sh --rollback`)
+2. Point `releases/manifest.json` back at the last-known-good version and push to mirrors
 3. Backend binary backup at `/usr/local/bin/archipelago.bak`

image-recipe/_archived/README.md

@@ -0,0 +1,37 @@
+# Archived ISO build recipes
+
+These scripts built the Archipelago auto-installer ISO (bundled and
+unbundled variants). As of v1.7.43-alpha, ISOs are no longer part of the
+release deliverable. Releases ship as tarballs consumed by
+`scripts/self-update.sh` on existing nodes.
+
+Archived here rather than deleted so they can be resurrected if ISO
+distribution is reintroduced.
+
+## Contents
+
+- `build-auto-installer-iso.sh` — orchestrator, bundles container images into squashfs
+- `build-unbundled-iso.sh` — thin wrapper that sets BUNDLE_IMAGES=0 and delegates
+- `test-iso-qemu.sh` — smoke-tests a built ISO under QEMU
+- `scripts/convert-iso-to-disk.sh` — converts an ISO to a raw disk image
+- `BUILD-ISO-STATUS.md`, `ISO-BUILD-CHECKLIST.md` — contributor guides
+- `branding/isohdpfx.bin` — isolinux MBR hybrid image
+- `.gitea-workflows/build-iso-dev.yml` — CI workflow that ran the build+smoke-test
+
+## To resurrect
+
+1. `git mv image-recipe/_archived/* image-recipe/` (adjust paths back)
+2. Restore `.gitea/workflows/build-iso-dev.yml`
+3. Re-add release-process references (see `scripts/create-release.sh`,
+   `docs/BETA-RELEASE-CHECKLIST.md`, `docs/hotfix-process.md`, `README.md`).
+
+## Why archived
+
+The release flow is simpler and faster as tarball-only:
+- `releases/vX.Y.Z-alpha/archipelago` (backend binary)
+- `releases/vX.Y.Z-alpha/archipelago-frontend-X.Y.Z-alpha.tar.gz` (frontend + AIUI + filebrowser UI assets)
+- `releases/manifest.json` (pointers + changelog)
+
+Nodes pull these via `scripts/self-update.sh` from either Gitea mirror.
+Filebrowser and AIUI remain bundled inside the frontend tarball and deployed
+atomically by `self-update.sh`.

scripts/create-release.sh

@@ -8,8 +8,8 @@
 #   ./scripts/create-release.sh 1.0.0         # Release v1.0.0
 #   ./scripts/create-release.sh 1.0.0 --dry-run  # Preview without changes
 #
-# ISO builds must be done on the target server separately:
-#   ssh archipelago@192.168.1.228 'cd ~/archy/image-recipe && sudo ./build-auto-installer-iso.sh'
+# Releases are tarball-only. ISO builds are archived under
+# image-recipe/_archived/. Nodes OTA-update from releases/manifest.json.
 
 set -euo pipefail
 
@@ -188,7 +188,8 @@ echo "  - Git tag: v${VERSION}"
 echo ""
 echo "Next steps:"
 echo "  1. Review: git log --oneline -5"
-echo "  2. Push:   git push && git push --tags"
-echo "  3. Build ISOs on server:"
-echo "     ssh archipelago@192.168.1.228 'cd ~/archy/image-recipe && sudo ./build-auto-installer-iso.sh'"
-echo "  4. Upload ISOs and manifest to distribution server"
+echo "  2. Push to gitea-local and gitea-vps2:"
+echo "       git push gitea-local main --tags && git push gitea-vps2 main --tags"
+echo "  3. Verify manifest is live on both mirrors:"
+echo "       curl -fsS http://localhost:3000/lfg2025/archy/raw/branch/main/releases/manifest.json"
+echo "       curl -fsS http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/releases/manifest.json"