fix: service file crash on fresh installs, CI workflow portability

- Remove MemoryDenyWriteExecute=yes from archipelago.service — ring
  (rustls) and secp256k1 (bitcoin/nostr) crypto libraries need
  executable memory mappings that this restriction blocks
- Add + prefix to ExecStartPre so mkdir/chown run as root
- Use $HOME/archy instead of /home/archipelago/archy in CI workflows
  so builds work on both .228 and VPS CI runners

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-iso-dev.yml

@@ -13,13 +13,14 @@ jobs:
       - name: Checkout
         run: |
           # Direct fetch + sync (actions/checkout token is broken on this Gitea)
-          cd /home/archipelago/archy && git fetch origin main && git reset --hard origin/main
+          REPO_DIR="$HOME/archy"
+          cd "$REPO_DIR" && git fetch origin main && git reset --hard origin/main
           echo "=== Source at commit: $(git log --oneline -1) ==="
           rsync -a --delete \
             --exclude '.git' --exclude 'node_modules' --exclude 'target' \
             --exclude 'image-recipe/build' --exclude 'image-recipe/results' \
             --exclude 'web/dist' \
-            /home/archipelago/archy/ "$GITHUB_WORKSPACE/"
+            "$REPO_DIR/" "$GITHUB_WORKSPACE/"
           cd "$GITHUB_WORKSPACE"
           echo "=== Workspace version: $(grep '^version' core/archipelago/Cargo.toml) ==="
           [ -f "scripts/first-boot-containers.sh" ] && echo "  first-boot-containers.sh: PRESENT" || echo "  first-boot-containers.sh: MISSING"