Advertise the native SV2 appliance endpoint

[keegreil]

Summary

• configure the packaged GridPool runtime to advertise native SV2 on port 34265
• replace restart-sensitive setup polling with an explicit Open GridPool dashboard button
• display the complete native SV2 connection contract, including the persisted Noise authority public key and AxeOS instructions
• expose private-appliance read-only diagnostics without a second GridPool password while keeping mutation APIs disabled
• bootstrap upgrade migrations from the versioned Compose definition so Umbrel's preserved older template directory cannot suppress package changes
• pin the merged runtime image and enforce endpoint, privacy, authority-key, and upgrade contracts in package verification

Validation

• upgraded the live Umbrel-dev package in place to 0.2.2-beta.7
• preserved node identity, payout configuration, consensus state, and the full 897-proof reserve
• verified Bitcoin tip/current/candidate agreement with Main
• verified Core RPC synchronized, read-only operator data available without a key, and private diagram details visible
• verified the dashboard API advertises the exact persisted SV2 authority public key
• configured a Bitaxe Gamma against the displayed endpoint and key; AxeOS accepted 10+ fresh shares after the final package restart with zero rejects and no fallback

Known separate release gate

The runtime image scan passes. The pinned SV2 image currently fails the package scan on two fixed Debian PCRE2 advisories and must be rebuilt/pinned before release.