feat: version-aware host-asset preflight for binary-swap deploys (#750)

A binary-swap deploy (make deploy or a manual spx copy) ships a new binary
whose host-config prerequisites — the privileged helper scripts and their
sudoers grant, placed only by setup.sh / setup-ovn.sh — it does not ship.
The node looks healthy and the gap surfaces later as a cryptic launch
failure or a silent security regression.

Add a preflight package that checks the host against what this build
expects, comparing asset content, not existence, so a stale-but-present
asset is caught too. The managed helpers install from quoted heredocs, so
their on-disk bytes equal the heredoc body verbatim; the binary carries
the canonical sha256s and compares.

- spinifex/preflight: CheckHost / CheckHostAt, content hash of the two
  managed helpers and a NOPASSWD grant-line check for the sysctl helper.
- Generated canonicalHashes plus a drift guard that re-extracts the
  heredocs and fails if the committed manifest no longer matches.
- Three surfaces: spx admin preflight, a make deploy gate
  (SKIP_ASSET_PREFLIGHT=1 to bypass), and a non-fatal daemon boot warning.

scripts/gen-asset-manifest.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# gen-asset-manifest.sh — extracts the canonical bytes of each managed asset
+# heredoc from the provisioning scripts, sha256s them, and (re)writes
+# spinifex/preflight/manifest_gen.go.
+#
+# Run this after editing a managed heredoc in setup.sh or setup-ovn.sh.
+# manifest_gen_test.go re-extracts the same heredocs and fails if the
+# committed manifest no longer matches, catching drift in CI.
+#
+# Usage: scripts/gen-asset-manifest.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+OUT="$ROOT/spinifex/preflight/manifest_gen.go"
+
+# extract_heredoc FILE ANCHOR
+# Prints the body of the first quoted 'HELPER' heredoc starting after the
+# first line containing ANCHOR — both scripts hold more than one such heredoc.
+extract_heredoc() {
+	local file=$1 anchor=$2
+	awk -v anchor="$anchor" '
+		state == 0 && index($0, anchor) { state = 1; next }
+		state == 1 && index($0, "<<") && index($0, "HELPER") { state = 2; next }
+		state == 2 && $0 == "HELPER" { exit }
+		state == 2 { print }
+	' "$file"
+}
+
+sysctl_hash=$(extract_heredoc "$ROOT/scripts/setup.sh" 'install_endpoint_sysctl_helper()' | sha256sum | cut -d' ' -f1)
+ovs_hash=$(extract_heredoc "$ROOT/scripts/setup-ovn.sh" 'Step 8: Grant the spinifex service users access to OVS/OVN' | sha256sum | cut -d' ' -f1)
+
+if [ -z "$sysctl_hash" ] || [ -z "$ovs_hash" ]; then
+	echo "gen-asset-manifest.sh: failed to extract one or both heredocs — anchors may be stale" >&2
+	exit 1
+fi
+
+mkdir -p "$(dirname "$OUT")"
+cat >"$OUT" <<EOF
+// Code generated by scripts/gen-asset-manifest.sh; DO NOT EDIT.
+
+package preflight
+
+var canonicalHashes = map[string]string{
+	"/usr/local/lib/spinifex/spinifex-set-endpoint-sysctl": "$sysctl_hash",
+	"/usr/local/lib/spinifex/ovs-socket-perms.sh":          "$ovs_hash",
+}
+EOF
+
+if command -v gofmt >/dev/null 2>&1; then
+	gofmt -w "$OUT"
+fi
+
+echo "wrote $OUT"
+echo "  spinifex-set-endpoint-sysctl: $sysctl_hash"
+echo "  ovs-socket-perms.sh:          $ovs_hash"