port startup-related changes from broken tree

Restores the boot/launch chain customizations on top of the freshly-reset
baseline. Driving-model and per-feature changes (dashcamd, telemetry, gpsd,
bench mode, manager wiring) are deliberately left out and will be ported
piecemeal.

Brought in:
- launch_openpilot.sh: kill stale instances, run on_start.sh, background
  vpn-monitor + nice-monitor, BENCH_MODE pass-through
- launch_chffrplus.sh: source build_preflight.sh, kill stale text-error UI
- build_only.sh, build_preflight.sh
- system/clearpilot/on_start.sh: SSH keys, ssh.service enable, git.hanson.xyz
  Host config, WiFi radio on, run provision.sh
- system/clearpilot/provision.sh + provision_wrapper.sh: connectivity wait,
  apt install (openvpn, curl, ccrypt, nodejs), Claude Code installer, git
  remote fix, fast-forward origin/clearpilot, /data/quick_boot
- system/clearpilot/vpn-monitor.sh + vpn.ovpn: OpenVPN tunnel auto-connect
- system/clearpilot/nice-monitor.sh: keep claude processes at nice 19
- system/clearpilot/dev: id_ed25519.{cpt,pub.cpt}, GithubSshKeys, encrypt.sh
  (DongleId-keyed instead of hardware-serial)
- system/clearpilot/tools/{decrypt,encrypt}: switch key source to DongleId
- system/clearpilot/startup_logo/{bg.jpg, generate_logo.sh, set_logo.sh}
- selfdrive/ui/qt/spinner{,.cc,.h}: new spinner with logo

Removed (baseline-only flow superseded by broken's on_start.sh+provision.sh):
- system/clearpilot/dev/on_start.sh
- system/clearpilot/dev/on_start_brian.sh.cpt
- system/clearpilot/dev/provision.sh

build_only.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/bash
+# CLEARPILOT: build-only mode — compile without starting manager.
+# On failure: shows error on screen (non-blocking) and exits nonzero with stderr output.
+# On success: exits 0, does not start manager.
+#
+# Usage: su - comma -c "bash /data/openpilot/build_only.sh"
+
+BASEDIR="/data/openpilot"
+
+# Fix ownership — we edit as root, openpilot builds/runs as comma
+sudo chown -R comma:comma "$BASEDIR"
+
+# Kill stale error displays and any running manager/launch/managed processes
+pkill -9 -f "selfdrive/ui/text" 2>/dev/null
+pkill -9 -f 'launch_openpilot.sh' 2>/dev/null
+pkill -9 -f 'launch_chffrplus.sh' 2>/dev/null
+pkill -9 -f 'python.*manager.py' 2>/dev/null
+pkill -9 -f 'selfdrive\.' 2>/dev/null
+pkill -9 -f 'system\.' 2>/dev/null
+pkill -9 -f './ui' 2>/dev/null
+sleep 1
+
+source "$BASEDIR/launch_env.sh"
+
+ln -sfn "$BASEDIR" /data/pythonpath
+export PYTHONPATH="$BASEDIR"
+
+# Hardware init (GPU perms)
+sudo chgrp gpu /dev/adsprpc-smd /dev/ion /dev/kgsl-3d0 2>/dev/null
+sudo chmod 660 /dev/adsprpc-smd /dev/ion /dev/kgsl-3d0 2>/dev/null
+
+# Preflight: create dirs git can't track
+source "$BASEDIR/build_preflight.sh"
+
+cd "$BASEDIR/selfdrive/manager"
+rm -f "$BASEDIR/prebuilt"
+
+BUILD_ONLY=1 exec ./build.py