Rework JB finalization: drop dropbear, auto-bootstrap on first boot (#141)

* fix: build

* fix: remove [trusted=yes] from Havoc apt source

The inline [trusted=yes] option can cause issues with Sileo's
source parser. The apt-get calls already use AllowUnauthenticated
flags, making it redundant.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: main actor crash in VPhoneControl + IPA extraction failures

VPhoneControl: pending request handlers are @MainActor-isolated closures
but were called from DispatchQueue.global() in the read loop and timeout
handler, causing dispatch_assert_queue_fail crashes. Wrap all
pending.handler() calls in DispatchQueue.main.async.

unarchive: the recent ARCHIVE_EXTRACT_SECURE_* hardening (ef02d50) broke
IPA extraction on iOS because:
- SECURE_NOABSOLUTEPATHS: we set absolute output paths on entries
- SECURE_SYMLINKS: iOS system paths (/var, /tmp) are symlinks
- archive_write_header failures were silently swallowed due to if/else if
  structure, making extraction report success with no files extracted

Fix by keeping only SECURE_NODOTDOT, resolving symlinks in extraction
path, fixing header error handling, removing unnecessary ACL/FFLAGS
flags, and surfacing libarchive errors in the install response.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* remove dropbear SSH daemon from guest

Drop all dropbear setup: LaunchDaemon plist injection, host key
generation, daemon deployment, and SSH availability messages.
Guest communication is handled by vphoned over vsock.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: liblaunch compat stub + automatic JB first-boot setup

liblaunch_compat.dylib: stub exporting _launch_active_user_switch
(missing from PCC VM's libSystem.B.dylib) so procursus binaries
like launchctl can load. Deployed to /cores/, loaded via
DYLD_INSERT_LIBRARIES in LaunchDaemon environment and JB profile.

vphone_jb_setup.sh: first-boot script replacing the SSH-based
cfw_install_jb_post.sh. Runs as a LaunchDaemon on first normal
boot and performs all JB finalization: /var/jb symlink,
prep_bootstrap, markers, Sileo, apt setup, TrollStore Lite.
Idempotent with done marker. Logs to /var/log/vphone_jb_setup.log.

Removes the cfw_install_jb_finalize make target and the entire
SSH/iproxy/sshpass-based post-boot flow from setup_machine.sh.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: update AGENTS.md firmware table, gitignore build artifacts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: launchctl wrapper uses absolute path + timeout to prevent hangs

- Use absolute path to launchctl.real instead of relative dirname,
  fixing "not found" when called via /var/jb/bin/launchctl symlink
- Add 5s timeout so launchctl doesn't hang when launchd is
  unresponsive on PCC VMs — always exits 0 for dpkg postinst compat
- Symlink /var/jb/bin/launchctl -> /var/jb/usr/bin/launchctl so both
  paths work (openssh postinst uses the /bin/ path)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: replace liblaunch_compat dylib stub with iosbinpack64 launchctl symlink

Procursus launchctl crashes on PCC VMs due to missing
_launch_active_user_switch symbol. Rather than a custom dylib stub,
simply symlink iosbinpack64's launchctl into /var/jb — it talks to
launchd fine and always exits 0, which is all dpkg scripts need.

- Remove liblaunch_compat.c, its build target, signing, and deployment
- Remove DYLD_INSERT_LIBRARIES from setup script and plist
- Replace launchctl wrapper with symlinks to /iosbinpack64/bin/launchctl
- Both /var/jb/usr/bin/launchctl and /var/jb/bin/launchctl are covered

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

scripts/cfw_install_dev.sh

@@ -477,7 +477,7 @@ cp "$TEMP_DIR/vphoned" "$VM_DIR/.vphoned.signed"
 echo "  [+] vphoned installed (signed copy at .vphoned.signed)"
 
 # Send daemon plists (overwrite on re-run)
-for plist in bash.plist dropbear.plist trollvnc.plist rpcserver_ios.plist; do
+for plist in bash.plist trollvnc.plist rpcserver_ios.plist; do
     scp_to "$INPUT_DIR/jb/LaunchDaemons/$plist" "/mnt1/System/Library/LaunchDaemons/"
     ssh_cmd "/bin/chmod 0644 /mnt1/System/Library/LaunchDaemons/$plist"
 done
@@ -517,7 +517,6 @@ rm -f "$TEMP_DIR/seputil" \
 echo ""
 echo "[+] CFW installation complete!"
 echo "    Reboot the device for changes to take effect."
-echo "    After boot, SSH will be available on port 22222 (password: alpine)"
 
 if [[ "$CFW_SKIP_HALT" == "1" ]]; then
     echo "[*] CFW_SKIP_HALT=1, skipping halt."