fix(packaging): workaround yauzl/Node 26 hang + fix API bootstrap contract

Packaging was silently hanging forever because yauzl 2.10.0 read streams
emit no data events under Node 26, causing extract-zip to block indefinitely
inside @electron/packager 20. Fix: postinstall script patches
@electron/packager/dist/unzip.js to use bsdtar (libarchive) instead.
bsdtar was chosen over 7z because 7z refuses chained symlinks in macOS
.app framework bundles. Both package:linux and package:mac now produce
correct output.

Also corrects the V3 API bootstrap contract in api_client.ts:
- SearchQuery body was wrapped in an extra {search_query: ...} layer — removed
- x-no-account-id header standardised to 'bypass'
- Redundant x-no-account-id removed from file download headers
- Smoke test rewritten to validate the real two-step bootstrap path

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dist/main/api_client.js

@@ -18,7 +18,7 @@ async function fetchFullConfig(seed) {
                 headers: {
                     'Content-Type': 'application/json',
                     'x-aether-api-key': seed.aether_api_key,
-                    'x-no-account-id': 'Nothing to See Here'
+                    'x-no-account-id': 'bypass'
                 },
             });
             if (!deviceResponse.ok) {
@@ -29,20 +29,16 @@ async function fetchFullConfig(seed) {
             // Use 'app_base_url' as the FQDN for the site lookup
             const fqdn = deviceData.app_base_url || 'native-demo.oneskyit.com';
             // --- STEP 2: Get Site Context ---
-            const searchUrl = `${baseUrl}/v3/crud/site_domain/search`;
+            const searchUrl = `${baseUrl}/v3/crud/site_domain/search?limit=1`;
             const siteResponse = await fetch(searchUrl, {
                 method: 'POST',
                 headers: {
                     'Content-Type': 'application/json',
                     'x-aether-api-key': seed.aether_api_key,
-                    'x-no-account-id': 'Nothing to See Here',
                     'x-account-id': deviceData.account_id_random || deviceData.account_id || ''
                 },
                 body: JSON.stringify({
-                    search_query: {
-                        and: [{ field: 'fqdn', op: 'eq', value: fqdn }]
-                    },
-                    limit: 1
+                    and: [{ field: 'fqdn', op: 'eq', value: fqdn }]
                 })
             });
             if (!siteResponse.ok) {