fix(iso): fail builds on missing VPN binaries, skip units cleanly, invalidate stale rootfs cache

v1.7.104 shipped ISOs whose units crash-looped (nostr-relay 3s loop,
archipelago-diag 203/EXEC) because build-time extraction failures were mere
warnings and the cached rootfs never tracked its recipe:

- hash the rootfs-defining region of the build script and rebuild when it
  changes (stale cache shipped ISOs without wpasupplicant/iw/rfkill)
- refuse to build without nvpn / nostr-rs-relay unless
  ALLOW_MISSING_VPN_BINARIES=1
- ConditionPathExists on nostr-relay/nostr-vpn/diag units so a stripped
  image skips them instead of crash-looping
- post-install test: every enabled archipelago*/nostr* unit must have an
  existing ExecStart payload

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

image-recipe/configs/nostr-relay.service

@@ -3,6 +3,9 @@ Description=Archipelago Private Nostr Relay
 After=network-online.target
 Wants=network-online.target
 Before=nostr-vpn.service
+# An ISO built without the relay binary (registry unreachable at build time)
+# must not crash-loop every 3s forever — skip cleanly instead.
+ConditionPathExists=/usr/local/bin/nostr-rs-relay
 
 [Service]
 Type=simple

image-recipe/configs/nostr-vpn.service

@@ -4,6 +4,9 @@ After=network-online.target tor.service archipelago.service
 Wants=network-online.target
 StartLimitIntervalSec=300
 StartLimitBurst=10
+# An ISO built without the nvpn binary (registry unreachable at build time)
+# must not restart-loop — skip cleanly instead.
+ConditionPathExists=/usr/local/bin/nvpn
 
 [Service]
 Type=simple