Portable install: the binary installs itself; static builds on five architectures; root via sudo, doas or uid 0; every package manager; older systemd; no lsblk

- hamlab install / uninstall (internal/setup): systemd or OpenRC, elevates through
  sudo or doas, runs as the invoking user, sets or generates the password, names only
  journal groups that exist, waits for /healthz, reports an active firewalld/ufw.
  --purge and the data chown never touch a directory that isn't Ham Lab's alone.
- install.sh: curl-able bootstrap (arch detection, SHA256SUMS, offline beside the
  binaries, noexec /tmp fallback). make release builds dist/ for amd64, arm64, arm
  (ARMv6), 386, riscv64. Every build is CGO_ENABLED=0; the native one used to link glibc.
- internal/priv replaces every literal `sudo -n`: uid 0, sudo or doas.
- Updates acts on dnf, zypper, pacman and apk as well as apt; dnf shows installed versions.
- Services falls back to the plain systemctl table before systemd 246 and says so on
  hosts without systemd. Disks falls back to /sys/block without lsblk.
- Listener binds with IP_FREEBIND, so a LAN address that isn't up at boot is no failure.
- Self-update: the new build must pass `check` against the live config, is put in
  place by atomic rename, and the daemon re-execs itself (same under any supervisor).
- State and config writes are fsynced; a corrupt state.json is set aside, not fatal.
- Terminal shutdown no longer empties the saved list, so names come back after a
  restart by design rather than by winning a race.
- Config default is ~/.config/hamlab; an existing ~/apps/hamlab is still found.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Makefile

@@ -3,33 +3,54 @@ VERSION ?= $(shell git describe --tags --always 2>/dev/null || echo dev)
 GO      ?= go
 PREFIX  ?= /usr/local/bin
 
-.PHONY: all web build dev deploy clean
+# every architecture a release carries; arm is ARMv6 hard-float, so it covers every Raspberry Pi
+ARCHES  ?= amd64 arm64 arm 386 riscv64
+LDFLAGS  = -s -w -X main.version=$(VERSION)
+# static, no cgo: the same file runs on glibc, musl (Alpine) and anything else with a Linux kernel
+GOBUILD  = CGO_ENABLED=0 GOOS=linux GOARM=6 $(GO) build -trimpath -ldflags "$(LDFLAGS)"
+
+.PHONY: all web build go dev cross release deploy push-nodes push-nodes-force test clean
 
 all: build
 
 web:
 	cd web && npm ci --no-audit --no-fund && npm run build
 
-build: web
-	$(GO) build -trimpath -ldflags "-s -w -X main.version=$(VERSION)" -o bin/hamlab ./cmd/hamlab
-
-# cross-compile for another Linux box (static binary, no cgo): make build-arm64 / build-amd64
-build-%: web
-	CGO_ENABLED=0 GOOS=linux GOARCH=$* $(GO) build -trimpath -ldflags "-s -w -X main.version=$(VERSION)" -o bin/hamlab-linux-$* ./cmd/hamlab
+build: web go
 
 # backend only (assumes web/dist already built)
 go:
-	$(GO) build -ldflags "-X main.version=$(VERSION)" -o bin/hamlab ./cmd/hamlab
+	$(GOBUILD) -o bin/hamlab ./cmd/hamlab
+
+# one other architecture: make build-arm64, build-arm, build-386, build-riscv64, build-amd64
+build-%: web
+	GOARCH=$* $(GOBUILD) -o bin/hamlab-linux-$* ./cmd/hamlab
 
 dev:
 	cd web && npm run dev
 
-# arm64 sibling for aarch64 machines (Mac mini); the hub pushes it to them
+# siblings for every other architecture; installed beside the binary, and the hub pushes
+# each managed machine the one that matches it
 cross:
-	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "-s -w -X main.version=$(VERSION)" -o bin/hamlab-linux-arm64 ./cmd/hamlab
+	@for a in $(filter-out $(shell $(GO) env GOARCH),$(ARCHES)); do \
+		echo "build linux/$$a"; GOARCH=$$a $(GOBUILD) -o bin/hamlab-linux-$$a ./cmd/hamlab || exit 1; done
 
+# dist/: one static binary per architecture, install.sh, SHA256SUMS. Serve the directory
+# anywhere (or attach it to a release) and install.sh does the rest.
+release: web
+	rm -rf dist && mkdir -p dist
+	@for a in $(ARCHES); do \
+		echo "build linux/$$a"; GOARCH=$$a $(GOBUILD) -o dist/hamlab-linux-$$a ./cmd/hamlab || exit 1; done
+	sed 's|@VERSION@|$(VERSION)|' install.sh > dist/install.sh && chmod +x dist/install.sh
+	cd dist && sha256sum hamlab-linux-* install.sh > SHA256SUMS
+
+test:
+	$(GO) vet ./... && $(GO) test ./...
+	sh -n install.sh
+
+# installs here (keeping the config, user and password), then updates every managed machine
 deploy: build cross
-	./deploy/install.sh
+	./bin/hamlab install --prefix $(PREFIX)
 	@sleep 1; $(PREFIX)/hamlab push-nodes || true
 
 # push the installed binary to every managed machine (what deploy does last)
@@ -41,4 +62,4 @@ push-nodes-force:
 	$(PREFIX)/hamlab push-nodes --force
 
 clean:
-	rm -rf bin internal/web/dist web/dist
+	rm -rf bin dist internal/web/dist web/dist