feat(wizard): the role select — one stick, three machines (#797 R3)

[VijitSingh97]

Phase R3 of #797: the installer page's first disclosure, above the disk, is now what the machine IS — one select reading exactly Pithead / Pithead + RigForge / RigForge. One page, three shapes; everything downstream reshapes to the answer exactly the way the disk choice already reshapes the form.

The three shapes

• Pithead — today's flow byte for byte. It is the default and the regression bar: every pre-existing wizard test passes unchanged (a client that never sends a role field is indistinguishable from today's).
• Pithead + RigForge — Pithead's form with the mine-on-this-machine switch preset to Yes. The role IS local_miner.enabled, the switch below stays live, and R2's boot leg already honours it — this role is fully live end to end on the current image.
• RigForge — the form collapses to: pool address (pre-filled by host-side discovery of a Pithead answering pithead.local:3333, published to the spool as rig-defaults.json the way the disk inventory travels, failing open to an empty field), worker name (defaults to the machine's own), optional stratum password. The disk section gains Run from this USB stick as a first-class target for this role only. The card shows the worker name and where it points — no dashboard credentials, because a rig has none.

Identical in every role: validation-before-erase (the host dials the pool before anything irreversible, the same discipline preflight_remote_nodes gives remote nodes), keep semantics (keep means KEEP — the survivor config wins and no role change crosses), the card-then-ack gate, self-power-off, headless first boot.

The machine-role contract

The accepted role lands where the boot path reads it, documented in docs/dev/appliance-wizard.md:

• /data/pithead/machine-role — pithead | both | rig; absent means pithead. Coordinator values are derivable from config.json; the rig value is load-bearing (a rig has no config.json).
• /data/pithead/rig.json — rig only: pool, worker, optional stratum password.
• A rig disk install stages pithead-rig.json on the ESP (carried by pithead-install beside the other pre-seeds); the target's first boot lands it as the two files above and scrubs the ESP copy.

Phasing, stated plainly: the rig BOOT LEG is R4, not this PR. A machine carrying the rig marker states its role on the console and stops — "rig provisioning lands with the next phase … nothing mines yet". The Both role is the one that goes end-to-end today.

Also in here: _console now narrates every line to the journal, not just the first — the honest-stub messages were journal-invisible without it, the same console-scrollback failure the wizard docs already record.

Coverage at the owning tiers

• server contracts: tests/web/test_wizard.py 63 → 73 (rig channel, pool shape gate, shared disk gates + usb, keep-path regression, rig defaults fail-open, status honesty)
• render probes + orchestration: tests/frontend/wizard.test.mjs 25 → 35 (select as first disclosure, three role shapes, discovery pre-fill, usb target rig-only, rig submit body, rig card, keep collapse)
• host logic: tests/stack/run.sh → 1935 passing (discovery publisher fail-open, firstboot_consume_rig validate-before-erase, marker + boot stub, staged-rig landing + ESP scrub)
• make lint green; dashboard coverage 96.65%; patch coverage vs develop-v2 100%

🤖 Generated with Claude Code