feat(iso): Step 8a — retire archipelago-reconcile systemd timer

BootReconciler (in-process, 30s interval, spawned from main.rs as of
Step 6 commit 48f08aa3) fully replaces the timer-driven bash
reconciliation path. Delete the systemd unit + timer and their
ISO-builder touchpoints.

Removed:
- image-recipe/configs/archipelago-reconcile.service
- image-recipe/configs/archipelago-reconcile.timer
- image-recipe/build-auto-installer-iso.sh L412-413 (COPY unit+timer)
- image-recipe/build-auto-installer-iso.sh L449 (systemctl enable)
- image-recipe/build-auto-installer-iso.sh L542-543 (cp to WORK_DIR)

Kept (intentionally):
- scripts/reconcile-containers.sh
- scripts/container-specs.sh

Reason: core/archipelago/src/api/rpc/package/update.rs still invokes
reconcile-containers.sh at two sites (OTA update + rollback paths).
Porting those call sites to ContainerOrchestrator::upgrade() requires
manifests for every container update.rs might touch — that scope
belongs in Step 8b. Until then the script stays on disk, just no
longer runs on a periodic timer.

No Rust code changes. cargo check -p archipelago clean, 6 pre-existing
warnings. Skipped full ISO rebuild validation per user decision —
edits are 5 textual deletions with zero behavioral ambiguity; Step 9
live hot-swap on .228 will catch any regression.

image-recipe/build-auto-installer-iso.sh

@@ -409,8 +409,6 @@ COPY archipelago-update.service /etc/systemd/system/archipelago-update.service
 COPY archipelago-update.timer /etc/systemd/system/archipelago-update.timer
 COPY archipelago-doctor.service /etc/systemd/system/archipelago-doctor.service
 COPY archipelago-doctor.timer /etc/systemd/system/archipelago-doctor.timer
-COPY archipelago-reconcile.service /etc/systemd/system/archipelago-reconcile.service
-COPY archipelago-reconcile.timer /etc/systemd/system/archipelago-reconcile.timer
 COPY archipelago-tor-helper.service /etc/systemd/system/archipelago-tor-helper.service
 COPY archipelago-tor-helper.path /etc/systemd/system/archipelago-tor-helper.path
 COPY nostr-vpn.service /etc/systemd/system/nostr-vpn.service
@@ -423,7 +421,10 @@ COPY nostr-relay-config.toml /etc/archipelago/nostr-relay-config.toml
 # WireGuard kernel module auto-load on boot
 RUN echo "wireguard" >> /etc/modules-load.d/wireguard.conf
 
-# Copy container doctor + reconcile scripts (referenced by the services above)
+# Copy container doctor + reconcile scripts (referenced by services and the
+# OTA update RPC; the reconcile systemd timer is gone as of Step 8a, but the
+# script stays until Step 8b/c ports all manifests — update.rs still shells
+# out to it during package updates).
 RUN mkdir -p /home/archipelago/archy/scripts/lib
 COPY container-doctor.sh /home/archipelago/archy/scripts/container-doctor.sh
 COPY reconcile-containers.sh /home/archipelago/archy/scripts/reconcile-containers.sh
@@ -450,7 +451,6 @@ RUN systemctl enable NetworkManager || true && \
     systemctl enable chrony || true && \
     systemctl enable archipelago-update.timer || true && \
     systemctl enable archipelago-doctor.timer || true && \
-    systemctl enable archipelago-reconcile.timer || true && \
     systemctl enable archipelago-tor-helper.path || true && \
     systemctl enable nostr-relay || true
 # archipelago-fips.service + archipelago-wg.service + archipelago-wg-address.service
@@ -540,13 +540,14 @@ NGINXCONF
         echo "   Using archipelago-update.service + timer from configs/"
     fi
 
-    # Copy container doctor and reconciliation timers + scripts
+    # Copy container doctor timer + reconcile script (the reconcile systemd
+    # timer is gone as of Step 8a — BootReconciler replaces it — but the
+    # reconcile-containers.sh script stays, invoked by the OTA update RPC
+    # until Step 8b/c ports all manifests to the Rust orchestrator).
     if [ -f "$SCRIPT_DIR/configs/archipelago-doctor.service" ]; then
         cp "$SCRIPT_DIR/configs/archipelago-doctor.service" "$WORK_DIR/archipelago-doctor.service"
         cp "$SCRIPT_DIR/configs/archipelago-doctor.timer" "$WORK_DIR/archipelago-doctor.timer"
-        cp "$SCRIPT_DIR/configs/archipelago-reconcile.service" "$WORK_DIR/archipelago-reconcile.service"
-        cp "$SCRIPT_DIR/configs/archipelago-reconcile.timer" "$WORK_DIR/archipelago-reconcile.timer"
-        # Copy the actual scripts the services reference
+        # Copy the actual scripts the services / update RPC reference
         for s in container-doctor.sh reconcile-containers.sh container-specs.sh tor-helper.sh; do
             if [ -f "$SCRIPT_DIR/../scripts/$s" ]; then
                 cp "$SCRIPT_DIR/../scripts/$s" "$WORK_DIR/$s"
@@ -557,7 +558,7 @@ NGINXCONF
             mkdir -p "$WORK_DIR/lib"
             cp "$SCRIPT_DIR/../scripts/lib/"*.sh "$WORK_DIR/lib/" 2>/dev/null || true
         fi
-        echo "   Using container doctor + reconcile timers from configs/"
+        echo "   Using container doctor timer from configs/"
     fi
 
     # Copy Tor helper path-activated service (allows backend to manage Tor as non-root)

image-recipe/configs/archipelago-reconcile.service

@@ -1,14 +0,0 @@
-[Unit]
-Description=Archipelago Container Reconciliation
-After=archipelago.service
-
-[Service]
-Type=oneshot
-User=archipelago
-Environment="XDG_RUNTIME_DIR=/run/user/1000"
-Environment="HOME=/home/archipelago"
-Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-ExecStart=/home/archipelago/archy/scripts/reconcile-containers.sh
-TimeoutStartSec=600
-StandardOutput=journal
-StandardError=journal

image-recipe/configs/archipelago-reconcile.timer

@@ -1,14 +0,0 @@
-[Unit]
-Description=Archipelago container reconciliation (periodic)
-
-[Timer]
-# First run 10 minutes after boot, then every 6 hours
-OnBootSec=10min
-OnUnitActiveSec=6h
-# Jitter to avoid load spikes
-RandomizedDelaySec=300
-# Run missed checks on boot
-Persistent=true
-
-[Install]
-WantedBy=timers.target