Add live RadiantWave updater (dev variants)

Add a radiantwave-updater NixOS module that polls a manifest on the
fileserver and swaps the app pointer /var/lib/radiantwave/current to new
closures fetched from the dev Attic cache. Closures are fetched with
'nix copy --from', never built from source; the swap is atomic via
mv -T.

Enable it on the -dev variants only for now: the login shell launches
from /var/lib/radiantwave/current/bin/radiantwave when enabled, and from
the immutable system path otherwise, so prod behavior is unchanged. The
pointer is seeded on first boot to the baseline copy already baked into
the closure (no duplication).

flake.nix

@@ -55,6 +55,18 @@
 
       revision = self.rev or self.dirtyRev or null;
 
+      # Live app-update side channel, dev-only for now. The manifest is
+      # served by the fileserver; closures are fetched (never built) from the
+      # dev Attic cache. Promotes to prod once validated.
+      radiantwaveDevUpdaterModule = { baseline }: {
+        services.radiantwaveUpdater = {
+          enable = true;
+          manifestUrl = "https://files.radiantwavetech.com/radiantwave-dev/manifest.json";
+          atticUrl = "https://attic.radiantwavetech.com/radiantwave-dev";
+          baselinePackage = baseline;
+        };
+      };
+
       mkKioskSystem = {
         system,
         radiantwave,
@@ -79,6 +91,7 @@
               system.configurationRevision = revision;
             }
             ./configuration.nix
+            ./radiantwave-updater.nix
             disko.nixosModules.disko
             diskModule
             nixos-facter-modules.nixosModules.facter
@@ -116,6 +129,7 @@
               ];
             })
             ./configuration.nix
+            ./radiantwave-updater.nix
             radiantwave.nixosModules.default
             {
               networking.hostName = hostName;
@@ -194,6 +208,9 @@
           hostName = "radiantwavekiosk-dev";
           diskModule = ./disk-config.nix;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-dev";
+          extraModules = [
+            (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.x86_64-linux.default; })
+          ];
         };
         radiantwavekiosk-commercial = mkKioskSystem {
           system = "x86_64-linux";
@@ -208,6 +225,9 @@
           hostName = "radiantwavekiosk-commercial-dev";
           diskModule = ./commercial-disk-config.nix;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-commercial-dev";
+          extraModules = [
+            (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.x86_64-linux.default; })
+          ];
         };
         # Rotated screen for android-style displays.
         radiantwavekiosk-android = mkKioskSystem {
@@ -228,6 +248,7 @@
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-android-dev";
           extraModules = [
             ./rotated_display.nix
+            (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.x86_64-linux.default; })
           ];
         };
         # Raspberry Pi 5.
@@ -240,6 +261,9 @@
           radiantwave = radiantwave-dev;
           hostName = "radiantwavekiosk-rpi-dev";
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git?ref=dev#radiantwavekiosk-rpi-dev";
+          extraModules = [
+            (radiantwaveDevUpdaterModule { baseline = radiantwave-dev.packages.aarch64-linux.default; })
+          ];
         };
 
         # === USB Images ===