port startup-related changes from broken tree

Restores the boot/launch chain customizations on top of the freshly-reset
baseline. Driving-model and per-feature changes (dashcamd, telemetry, gpsd,
bench mode, manager wiring) are deliberately left out and will be ported
piecemeal.

Brought in:
- launch_openpilot.sh: kill stale instances, run on_start.sh, background
  vpn-monitor + nice-monitor, BENCH_MODE pass-through
- launch_chffrplus.sh: source build_preflight.sh, kill stale text-error UI
- build_only.sh, build_preflight.sh
- system/clearpilot/on_start.sh: SSH keys, ssh.service enable, git.hanson.xyz
  Host config, WiFi radio on, run provision.sh
- system/clearpilot/provision.sh + provision_wrapper.sh: connectivity wait,
  apt install (openvpn, curl, ccrypt, nodejs), Claude Code installer, git
  remote fix, fast-forward origin/clearpilot, /data/quick_boot
- system/clearpilot/vpn-monitor.sh + vpn.ovpn: OpenVPN tunnel auto-connect
- system/clearpilot/nice-monitor.sh: keep claude processes at nice 19
- system/clearpilot/dev: id_ed25519.{cpt,pub.cpt}, GithubSshKeys, encrypt.sh
  (DongleId-keyed instead of hardware-serial)
- system/clearpilot/tools/{decrypt,encrypt}: switch key source to DongleId
- system/clearpilot/startup_logo/{bg.jpg, generate_logo.sh, set_logo.sh}
- selfdrive/ui/qt/spinner{,.cc,.h}: new spinner with logo

Removed (baseline-only flow superseded by broken's on_start.sh+provision.sh):
- system/clearpilot/dev/on_start.sh
- system/clearpilot/dev/on_start_brian.sh.cpt
- system/clearpilot/dev/provision.sh

system/clearpilot/on_start.sh

@@ -3,5 +3,45 @@
 # Install logo
 bash /data/openpilot/system/clearpilot/startup_logo/set_logo.sh
 
-# Reverse ssh if brianbot dongle id
-bash /data/openpilot/system/clearpilot/dev/on_start.sh
+# SSH — always, unconditionally, first thing
+cat /data/openpilot/system/clearpilot/dev/GithubSshKeys > /data/params/d/GithubSshKeys
+echo -n 1 > /data/params/d/SshEnabled
+sudo systemctl enable ssh 2>/dev/null
+sudo systemctl start ssh
+
+# Decrypt and install SSH identity keys for root (git auth)
+serial=$(sed 's/.*androidboot.serialno=\([^ ]*\).*/\1/' /proc/cmdline)
+ssh_dir="/root/.ssh"
+if [[ $serial == 3889765b ]] && [[ ! -f "$ssh_dir/id_ed25519" || ! -f "$ssh_dir/id_ed25519.pub" ]]; then
+    echo "Decrypting SSH identity keys for root (serial=$serial)..."
+    tmpdir=$(mktemp -d)
+    bash /data/openpilot/system/clearpilot/tools/decrypt /data/openpilot/system/clearpilot/dev/id_ed25519.cpt "$tmpdir/id_ed25519"
+    bash /data/openpilot/system/clearpilot/tools/decrypt /data/openpilot/system/clearpilot/dev/id_ed25519.pub.cpt "$tmpdir/id_ed25519.pub"
+    sudo mkdir -p "$ssh_dir"
+    sudo cp "$tmpdir/id_ed25519" "$tmpdir/id_ed25519.pub" "$ssh_dir/"
+    rm -rf "$tmpdir"
+    sudo chmod 700 "$ssh_dir"
+    sudo chmod 600 "$ssh_dir/id_ed25519"
+    sudo chmod 644 "$ssh_dir/id_ed25519.pub"
+    echo "SSH identity keys installed to $ssh_dir"
+fi
+
+# Ensure root SSH config has git.hanson.xyz entry
+if ! grep -q "Host git.hanson.xyz" "$ssh_dir/config" 2>/dev/null; then
+    sudo tee -a "$ssh_dir/config" > /dev/null <<'SSHCFG'
+
+Host git.hanson.xyz
+    IdentityFile /root/.ssh/id_ed25519
+    StrictHostKeyChecking no
+SSHCFG
+    sudo chmod 600 "$ssh_dir/config"
+    echo "SSH config updated for git.hanson.xyz"
+fi
+
+# Always ensure WiFi radio is on
+nmcli radio wifi on 2>/dev/null
+
+# Provision (packages, git pull, build) if no quick_boot flag
+if [ ! -f /data/quick_boot ]; then
+    sudo bash /data/openpilot/system/clearpilot/provision.sh
+fi