fix: netavark GLIBC mismatch in ISO, container adopt, app updates

ISO build no longer copies netavark from build host (Debian 13/GLIBC 2.41)
which broke container networking on Debian 12 targets. Rootfs already
installs netavark from Debian 12 repos — just configure the backend.

Install RPC now adopts existing containers (from first-boot) instead of
erroring on duplicates. Container scanner extracts real versions from
image tags and detects available updates against pinned versions.

Frontend shows update button with version info when updates are available.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/archipelago/src/container/docker_packages.rs

@@ -11,6 +11,7 @@ use crate::data_model::{
     Description, InstalledPackageDataEntry, InterfaceAddress, Interfaces, MainInterface, Manifest,
     PackageDataEntry, PackageState, ServiceStatus, StaticFiles,
 };
+use super::image_versions;
 
 pub struct DockerPackageScanner {
     runtime: Arc<dyn ContainerRuntimeTrait>,
@@ -149,6 +150,25 @@ impl DockerPackageScanner {
             
             let tor_address = read_tor_address(&app_id).await;
 
+            // Extract actual version from container image tag
+            let running_version = image_versions::extract_version_from_image(&container.image);
+
+            // Check for available update by comparing running image vs pinned image
+            let available_update = image_versions::pinned_image_for_app(&app_id)
+                .and_then(|pinned| {
+                    if pinned != container.image {
+                        let pinned_version = image_versions::extract_version_from_image(&pinned);
+                        // Don't flag if both are "latest" — no meaningful diff
+                        if pinned_version != "latest" || running_version != "latest" {
+                            Some(pinned_version)
+                        } else {
+                            None
+                        }
+                    } else {
+                        None
+                    }
+                });
+
             let package = PackageDataEntry {
                 state: package_state.clone(),
                 health: container.health.clone(),
@@ -161,7 +181,7 @@ impl DockerPackageScanner {
                 manifest: Manifest {
                     id: app_id.clone(),
                     title: metadata.title.clone(),
-                    version: "1.0.0".to_string(),
+                    version: running_version,
                     description: Description {
                         short: metadata.description.clone(),
                         long: metadata.description.clone(),
@@ -188,6 +208,7 @@ impl DockerPackageScanner {
                         None
                     },
                 },
+                available_update,
                 installed: Some(InstalledPackageDataEntry {
                     current_dependents: HashMap::new(),
                     current_dependencies: HashMap::new(),
@@ -627,5 +648,6 @@ fn package_state_str(state: &PackageState) -> &str {
         PackageState::RestoringBackup => "restoring-backup",
         PackageState::Removing => "removing",
         PackageState::BackingUp => "backing-up",
+        PackageState::Updating => "updating",
     }
 }