feat(packaging): nix web console + plugin/script runner everywhere; fix tray zbus/tokio crash

Ship the management web console and the plugin/script runner across the packaging
matrix, and fix a Linux tray startup crash.

- nix: add punktfunk-web (Nitro SSR on bun) and punktfunk-scripting (Effect runner),
  with services.punktfunk.{web,scripting} modules. Both bun node_modules come from
  fixed-output derivations pinned to real deps hashes; patchShebangs the web
  node_modules so orval/paraglide/vite run in the sandbox. Validated on x86_64-linux
  (nix build .#punktfunk-{web,scripting,tray,host} all green).

- punktfunk-scripting now ships for deb/rpm/arch/nix/windows, mirroring the web-console
  mechanics (vendored bun on deb/rpm/arch, pkgs.bun on nix; one self-contained
  `bun build --target=bun` bundle). Opt-in: host Recommends it, but the systemd --user
  unit ships un-started (Windows registers its scheduled task disabled).

- fix(tray): build punktfunk-tray in its OWN cargo invocation on nix/rpm/arch. Cargo
  unifies features across one `cargo build`, so co-building the tray with the host pulls
  the host's ashpd->zbus/tokio onto the tray's shared zbus and it panics at startup
  ("there is no reactor running, must be called from the context of a Tokio 1.x
  runtime"). Isolated, the tray's zbus stays on async-io. The .deb already did this;
  runtime-verified on nix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/punktfunk-scripting.service

@@ -0,0 +1,34 @@
+# punktfunk plugin/script runner — systemd USER unit (bun runtime, OPT-IN).
+#
+# Runs the operator's automation under supervision: loose files in ~/.config/punktfunk/scripts/ and
+# installed `punktfunk-plugin-*` packages under ~/.config/punktfunk/plugins/. Each unit is an Effect
+# fiber (a plugin restarts on failure with capped-jittered backoff; a bare script is one-shot).
+# SIGTERM interrupts the whole tree STRUCTURALLY, so every plugin's scoped finalizers run before
+# exit (clean deregister / preset release) — hence the generous stop timeout below.
+#
+# OPT-IN — unlike punktfunk-web, the package does NOT auto-enable this: the runner does nothing until
+# you add scripts or install plugins. Turn it on once you have automation to run:
+#   systemctl --user enable --now punktfunk-scripting
+#
+# Auto-wired like the console: a plugin's connect() reads the host's mgmt token + identity cert from
+# ~/.config/punktfunk/{mgmt-token,cert.pem} (written by the host's `serve`) — no env editing.
+[Unit]
+Description=punktfunk plugin/script runner
+Documentation=https://git.unom.io/unom/punktfunk
+# Plugins talk to the host's loopback mgmt API; order after it. Soft (ordering only, no Requires):
+# the runner supervises each unit with backoff, so a plugin started before the host simply retries.
+After=punktfunk-host.service
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/punktfunk-scripting
+Restart=on-failure
+RestartSec=2
+# Deliver the stop signal to the runner process itself (it orchestrates the structural shutdown of
+# its unit fibers), and give it room to run their finalizers before the cgroup is reaped.
+KillMode=mixed
+KillSignal=SIGTERM
+TimeoutStopSec=30
+
+[Install]
+WantedBy=default.target

scripts/windows/scripting-run.cmd

@@ -0,0 +1,27 @@
+@echo off
+rem punktfunk plugin/script runner launcher - the action the PunktfunkScripting scheduled task runs.
+rem
+rem OPT-IN: the installer registers that task DISABLED (the runner is inert until you add automation).
+rem Enable it once you have scripts/plugins:  Enable-ScheduledTask -TaskName PunktfunkScripting
+rem
+rem Lays out next to the installed payload: {app}\scripting\scripting-run.cmd + runner-cli.js and
+rem {app}\bun\bun.exe (so %~dp0 = {app}\scripting\). The runner discovers the operator's units under
+rem %ProgramData%\punktfunk\{scripts,plugins}; a plugin's connect() auto-wires to the host's mgmt
+rem token + identity cert in %ProgramData%\punktfunk\ (written by the host's `serve`). No env editing.
+setlocal EnableExtensions
+
+set "BUN=%~dp0..\bun\bun.exe"
+set "RUNNER=%~dp0runner-cli.js"
+
+if not exist "%RUNNER%" (
+  echo [punktfunk-scripting] runner bundle missing at "%RUNNER%".
+  exit /b 1
+)
+if not exist "%BUN%" (
+  echo [punktfunk-scripting] bundled bun missing at "%BUN%".
+  exit /b 1
+)
+
+rem The runner import()s the operator's .ts plugin files, so it runs on the bundled bun. SIGTERM (task
+rem End) interrupts the whole unit tree structurally so plugin finalizers run before exit.
+"%BUN%" "%RUNNER%"