feat(fnos): run entirely without root and harden process lifecycle

- Switch privilege model to run-as: package (zero root, per fnOS guide)
- Borrow App Store python312 instead of bundling CPython; keep bundled uv
- Move venv, HOME and caches onto the persistent data share
- Start service via setsid; stop/upgrade kill the whole process group
- Sweep stray runtime/box orphans in install/upgrade init hooks
- Track LangBot 4.10.11 (manifest baseline + upstream merge)

packaging/fnos/cmd/install_init

@@ -1,5 +1,12 @@
 #!/bin/bash
-# cmd/install_init - pre-install hook
-# Nothing special to do before extraction.
+# cmd/install_init - pre-install hook (runs before files are applied)
+# Sweep stray processes from a previous failed/killed install: orphans whose
+# parent was hard-killed keep running and hold the runtime/box ws ports,
+# which breaks the new instance. No match is the normal case on a clean
+# install — pkill exits 1.
+
+RUN_USER=$(id -un)
+pkill -KILL -u "${RUN_USER}" -f "appcenter/langbot" 2>/dev/null || true
+pkill -KILL -u "${RUN_USER}" -f "appshare/langbot" 2>/dev/null || true
 
 exit 0