feat: complete OS update pipeline — extraction, notifications, CI publishing

- update.rs: extract frontend .tar.gz archives during apply (was TODO/skip)
- update.rs: back up current frontend before extraction, set binary perms
- server.rs: periodic scan reads update_state.json, sets status_info.updated
  flag and broadcasts via WebSocket so frontend gets notified automatically
- build-iso-dev.yml: publish binary + frontend archive + manifest.json with
  SHA256 hashes to /Builds/releases/v{version}/ after each build

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/server.rs

@@ -471,7 +471,14 @@ async fn scan_and_update_packages(
     let tor_changed = tor_addr != current_data.server_info.tor_address;
     let first_scan = !current_data.server_info.status_info.containers_scanned;
 
-    if packages_changed || tor_changed || first_scan {
+    // Check if update scheduler has found an available update
+    let update_available = crate::update::load_state(std::path::Path::new("/var/lib/archipelago"))
+        .await
+        .map(|s| s.available_update.is_some())
+        .unwrap_or(false);
+    let update_changed = update_available != current_data.server_info.status_info.updated;
+
+    if packages_changed || tor_changed || first_scan || update_changed {
         let mut data = current_data;
         if !packages.is_empty() {
             data.package_data = packages;
@@ -479,8 +486,9 @@ async fn scan_and_update_packages(
         data.server_info.tor_address = tor_addr.clone();
         data.server_info.node_address = tor_addr.as_ref().map(|t| identity.node_address(t));
         data.server_info.status_info.containers_scanned = true;
+        data.server_info.status_info.updated = update_available;
         state.update_data(data).await;
-        debug!("📦 State changed (packages={}, tor={}, first_scan={}), broadcasting update", packages_changed, tor_changed, first_scan);
+        debug!("📦 State changed (packages={}, tor={}, first_scan={}, update={}), broadcasting update", packages_changed, tor_changed, first_scan, update_changed);
     }
 
     Ok(())

core/archipelago/src/update.rs

@@ -260,27 +260,48 @@ pub async fn apply_update(data_dir: &Path) -> Result<()> {
         let name = entry.file_name().to_string_lossy().to_string();
         let src = entry.path();
 
-        // Map component names to destinations
-        let dest = match name.as_str() {
-            "archipelago" => Some(Path::new("/usr/local/bin/archipelago").to_path_buf()),
-            _ => {
-                // For frontend or config files, determine destination
-                if name.ends_with(".tar.gz") || name.ends_with(".zip") {
-                    // Archive — extract to appropriate location
-                    debug!(name = %name, "Skipping archive (manual extraction needed)");
-                    None
-                } else {
-                    debug!(name = %name, "Unknown component, skipping");
-                    None
+        match name.as_str() {
+            "archipelago" => {
+                let dest = Path::new("/usr/local/bin/archipelago");
+                fs::copy(&src, dest)
+                    .await
+                    .with_context(|| format!("Failed to apply {}", name))?;
+                #[cfg(unix)]
+                {
+                    use std::os::unix::fs::PermissionsExt;
+                    std::fs::set_permissions(dest, std::fs::Permissions::from_mode(0o755))
+                        .context("Failed to set binary permissions")?;
                 }
+                info!(name = %name, "Backend binary applied");
+            }
+            _ if name.contains("frontend") && name.ends_with(".tar.gz") => {
+                let web_ui_dir = Path::new("/opt/archipelago/web-ui");
+                // Back up current frontend
+                let frontend_backup = backup_dir.join("web-ui-backup.tar.gz");
+                if web_ui_dir.exists() {
+                    let status = tokio::process::Command::new("tar")
+                        .args(["-czf", &frontend_backup.to_string_lossy(), "-C", "/opt/archipelago", "web-ui"])
+                        .status()
+                        .await
+                        .context("Failed to backup frontend")?;
+                    if status.success() {
+                        info!("Frontend backed up");
+                    }
+                }
+                // Extract new frontend
+                let status = tokio::process::Command::new("tar")
+                    .args(["-xzf", &src.to_string_lossy(), "-C", "/opt/archipelago"])
+                    .status()
+                    .await
+                    .with_context(|| format!("Failed to extract {}", name))?;
+                if !status.success() {
+                    anyhow::bail!("tar extraction failed for {}", name);
+                }
+                info!(name = %name, "Frontend archive extracted to /opt/archipelago/web-ui");
+            }
+            _ => {
+                debug!(name = %name, "Unknown component, skipping");
             }
-        };
-
-        if let Some(dest_path) = dest {
-            fs::copy(&src, &dest_path)
-                .await
-                .with_context(|| format!("Failed to apply {}", name))?;
-            info!(name = %name, dest = %dest_path.display(), "Component applied");
         }
     }