fix(banner): console banner shows the reachable LAN address, not the WG tunnel IP

The welcome banner picked its address with 'hostname -I | awk {print $1}',
so a node with WireGuard up advertised 10.44.0.1 — its own tunnel address,
present on EVERY node — as its web ui / ssh address. Off-tunnel that is
unreachable, and after a headless box moves to a new network it is exactly
the wrong thing to trust (framework-pt, 2026-08-15).

- Pick the default route's source address; fall back to the first address
  that is not WireGuard 10.44/16, CGNAT 100.64/10, or loopback.
- Also print http://<hostname>.local when avahi is up — the one address
  that survives any DHCP change, which is the real answer for headless
  boxes that move between networks.
- scripts/welcome-banner.sh is the new canonical copy, embedded in the
  binary (tor-helper pattern): bootstrap::run_welcome_banner_sync rewrites
  /etc/profile.d/archipelago.sh on ISO-installed nodes at startup, so the
  fix reaches the deployed fleet with the next OTA instead of only fresh
  ISOs. Machines without an installer-baked banner are left untouched.
- Same fix inlined in the live ISO builder's PROFILE heredoc
  (image-recipe/_archived/build-auto-installer-iso.sh).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/bootstrap.rs

@@ -171,6 +171,13 @@ pub async fn ensure_doctor_installed() {
         Ok(false) => debug!("tor-helper.sh already current"),
         Err(e) => warn!("tor-helper sync failed (non-fatal): {:#}", e),
     }
+    match run_welcome_banner_sync().await {
+        Ok(true) => info!(
+            "Console welcome banner synchronized (LAN address + .local name, not the WG tunnel IP)"
+        ),
+        Ok(false) => debug!("Console welcome banner already current (or not an ISO node)"),
+        Err(e) => warn!("Welcome banner sync failed (non-fatal): {:#}", e),
+    }
     match run_tor_torrc_repair().await {
         Ok(true) => info!("Tor healed at boot (torrc rebuilt and/or daemon restarted)"),
         Ok(false) => debug!("Tor healthy and torrc in sync — no heal needed"),
@@ -654,6 +661,44 @@ exit 2
 const TOR_HELPER_SH: &str = include_str!("../../../scripts/tor-helper.sh");
 const TOR_HELPER_PATH: &str = "/opt/archipelago/scripts/tor-helper.sh";
 
+/// The console welcome banner, embedded so the OTA can fix it on deployed
+/// nodes. `/etc/profile.d/archipelago.sh` is baked by the ISO installer and
+/// no OTA path touched it, so every node kept whatever its ISO generation
+/// shipped — including banners that print the node's own WireGuard address
+/// (10.44.0.1, present on EVERY node) as the "web ui", which is unreachable
+/// off-tunnel and actively misleading after a move to a new network
+/// (framework-pt, 2026-08-15). Canonical copy: scripts/welcome-banner.sh;
+/// the ISO builder inlines the same content for fresh installs.
+const WELCOME_BANNER_SH: &str = include_str!("../../../scripts/welcome-banner.sh");
+const WELCOME_BANNER_PATH: &str = "/etc/profile.d/archipelago.sh";
+
+async fn run_welcome_banner_sync() -> Result<bool> {
+    let current = tokio::fs::read_to_string(WELCOME_BANNER_PATH)
+        .await
+        .unwrap_or_default();
+    // Only refresh a banner the installer put there: a dev machine running
+    // the backend from a checkout has no business growing one in /etc.
+    if current.is_empty() || current == WELCOME_BANNER_SH {
+        return Ok(false);
+    }
+    let staged = "/var/lib/archipelago/welcome-banner.staged";
+    if let Some(dir) = Path::new(staged).parent() {
+        tokio::fs::create_dir_all(dir).await.ok();
+    }
+    tokio::fs::write(staged, WELCOME_BANNER_SH)
+        .await
+        .context("stage welcome banner")?;
+    let script = format!(
+        "set -eu\ninstall -m 0755 {staged} {dest}\nexit 0\n",
+        staged = staged,
+        dest = WELCOME_BANNER_PATH
+    );
+    host_sudo(&["sh", "-lc", &script])
+        .await
+        .context("install welcome banner")?;
+    Ok(true)
+}
+
 async fn run_tor_helper_sync() -> Result<bool> {
     let current = tokio::fs::read_to_string(TOR_HELPER_PATH)
         .await