feat(mesh): ship archy-rnodeconf on every node, wire daemon tools into deploy

RNS's own rnodeconf utility (frequency/bandwidth/spreading-factor/coding-rate
read+write, firmware signature verification, board bootstrap) has been the
one tool that reliably diagnoses real RNode hardware — it's what finally
proved two live nodes were silently running at different spreading factors
(SF5 vs SF10, invisible from any of our own probe/logging code, and the
actual reason two correctly-flashed radios could detect each other's RF but
never decode a packet). Every node should have it, not just whichever one an
agent happened to build a throwaway venv on to debug a specific incident.

- reticulum-daemon/build.sh: also PyInstaller-package archy-rnodeconf
  alongside the existing archy-reticulum-daemon, same --collect-submodules/
  -d noarchive flags (same RNS.Interfaces __all__-glob requirement applies).
- scripts/deploy-to-target.sh: actually wire both packaged binaries into the
  live deploy path (neither was wired in before — a pre-existing gap noted
  in docs/RETICULUM-TRANSPORT-PROGRESS.md; this is why reticulum-daemon
  previously only worked via manual dev-venv setup on rsync-deployed nodes,
  not the ISO-imaged ones). Non-fatal on build/deploy failure — archipelago
  already falls back to its dev-venv path if the packaged binary is absent.
  Also installs the missing `python3.<minor>-venv` package when needed
  (same "ensurepip not available" gap hit manually twice this session).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

reticulum-daemon/build.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
-# Build the PyInstaller single-binary for the OTA (plan Phase 1 packaging).
-# Output: dist/archy-reticulum-daemon — drop next to /usr/local/bin/archipelago.
+# Build the PyInstaller single-binaries for the OTA (plan Phase 1 packaging).
+# Outputs: dist/archy-reticulum-daemon, dist/archy-rnodeconf — drop both next
+# to /usr/local/bin/archipelago.
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
@@ -9,7 +10,7 @@ if [ ! -d .venv ]; then
 fi
 .venv/bin/pip install -q -r requirements.txt -r requirements-build.txt
 
-rm -rf build dist archy-reticulum-daemon.spec
+rm -rf build dist archy-reticulum-daemon.spec archy-rnodeconf.spec
 
 # --collect-submodules: RNS/LXMF load most of their own internals dynamically
 # (interface drivers, transport backends), which PyInstaller's static import
@@ -30,3 +31,24 @@ rm -rf build dist archy-reticulum-daemon.spec
     reticulum_daemon.py
 
 echo "Built dist/archy-reticulum-daemon ($(du -h dist/archy-reticulum-daemon | cut -f1))"
+
+# archy-rnodeconf: RNS's own official RNode config/diagnostic tool
+# (RNS.Utilities.rnodeconf — reads/sets frequency, bandwidth, spreading
+# factor, coding rate, TX power on an attached RNode; also verifies firmware
+# signatures and can flash/bootstrap a board). Shipped alongside the daemon
+# so every node can inspect and reconfigure its own radio without needing a
+# full RNS/Python dev environment set up by hand — see the checkpoint in
+# docs/RETICULUM-TRANSPORT-PROGRESS.md for the incident (two nodes silently
+# running at different spreading factors, invisible without this tool) that
+# motivated shipping it as a first-class OS tool rather than an ad hoc script.
+RNODECONF_SRC="$(find .venv/lib -maxdepth 5 -path '*/site-packages/RNS/Utilities/rnodeconf.py' -print -quit)"
+if [ -n "$RNODECONF_SRC" ] && [ -f "$RNODECONF_SRC" ]; then
+    .venv/bin/pyinstaller --onefile --name archy-rnodeconf --clean --noconfirm \
+        --collect-submodules RNS \
+        --collect-data RNS \
+        -d noarchive \
+        "$RNODECONF_SRC"
+    echo "Built dist/archy-rnodeconf ($(du -h dist/archy-rnodeconf | cut -f1))"
+else
+    echo "WARNING: rnodeconf.py not found at $RNODECONF_SRC (RNS version mismatch?) — skipping archy-rnodeconf build" >&2
+fi