feat(fnos): run entirely without root and harden process lifecycle

- Switch privilege model to run-as: package (zero root, per fnOS guide)
- Borrow App Store python312 instead of bundling CPython; keep bundled uv
- Move venv, HOME and caches onto the persistent data share
- Start service via setsid; stop/upgrade kill the whole process group
- Sweep stray runtime/box orphans in install/upgrade init hooks
- Track LangBot 4.10.11 (manifest baseline + upstream merge)

packaging/fnos/README.md

@@ -2,6 +2,10 @@
 
 This directory packages LangBot as a `.fpk` app for the fnOS App Store. It is a native deployment: no Docker involved — uv creates a Python virtual environment directly on the NAS, and Node.js v22 from the fnOS App Store provides the Box sandbox and npx MCP capabilities.
 
+## Privilege Model
+
+Per the [fnOS privilege docs](https://developer.fnnas.com/docs/core-concepts/privilege/), the whole app runs as the dedicated package user (`run-as: package`; username auto-generated by fnOS from `appname`) — no root anywhere. The official App Store apps `nodejs_v22` and `python312` (declared in `manifest` via `install_dep_apps`) are borrowed from `/var/apps/` cross-app. `HOME` is pointed at `<data>/.home` inside the persistent share so tool caches (uv, npm/npx MCP) stay writable regardless of the generated user's system home.
+
 ## Directory Structure
 
 ```
@@ -10,10 +14,10 @@ packaging/fnos/
 ├── build.sh                    # One-shot build script (shared by local and CI)
 ├── LICENSE
 ├── config/
-│   ├── privilege               # Privilege config (run-as: root)
+│   ├── privilege               # Privilege config (run-as: package, no root)
 │   └── resource                # Persistent data share declaration (langbot/data)
 ├── cmd/                        # Lifecycle scripts (fnOS invokes them with TRIM_* env vars)
-│   ├── main                    # Service start/stop manager (start/stop/status, owns PID/log)
+│   ├── main                    # Service start/stop manager (start/stop/status, owns PID/log); started via setsid, stop kills the whole process group
 │   ├── install_init            # Pre-install hook
 │   ├── install_callback        # Post-install hook: create venv, uv sync deps, seed config.yaml port
 │   ├── upgrade_init            # Pre-upgrade hook