fix(packaging): workaround yauzl/Node 26 hang + fix API bootstrap contract

Packaging was silently hanging forever because yauzl 2.10.0 read streams
emit no data events under Node 26, causing extract-zip to block indefinitely
inside @electron/packager 20. Fix: postinstall script patches
@electron/packager/dist/unzip.js to use bsdtar (libarchive) instead.
bsdtar was chosen over 7z because 7z refuses chained symlinks in macOS
.app framework bundles. Both package:linux and package:mac now produce
correct output.

Also corrects the V3 API bootstrap contract in api_client.ts:
- SearchQuery body was wrapped in an extra {search_query: ...} layer — removed
- x-no-account-id header standardised to 'bypass'
- Redundant x-no-account-id removed from file download headers
- Smoke test rewritten to validate the real two-step bootstrap path

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/main/api_client.ts

@@ -12,15 +12,15 @@ export async function fetchFullConfig(seed: SeedConfig): Promise<any> {
   for (const baseUrl of apiUrls) {
     try {
       console.log(`Bootstrap: Attempting connection to ${baseUrl}...`);
-      
+
       // --- STEP 1: Get Device Config ---
       const deviceUrl = `${baseUrl}/v3/crud/event_device/${seed.event_device_id}`;
       const deviceResponse = await fetch(deviceUrl, {
-        method: 'GET', 
+        method: 'GET',
         headers: {
           'Content-Type': 'application/json',
           'x-aether-api-key': seed.aether_api_key,
-          'x-no-account-id': 'Nothing to See Here'
+          'x-no-account-id': 'bypass'
         },
       });
 
@@ -30,25 +30,21 @@ export async function fetchFullConfig(seed: SeedConfig): Promise<any> {
 
       const deviceResult = await deviceResponse.json();
       const deviceData = deviceResult.data || deviceResult;
-      
+
       // Use 'app_base_url' as the FQDN for the site lookup
       const fqdn = deviceData.app_base_url || 'native-demo.oneskyit.com';
 
       // --- STEP 2: Get Site Context ---
-      const searchUrl = `${baseUrl}/v3/crud/site_domain/search`;
+      const searchUrl = `${baseUrl}/v3/crud/site_domain/search?limit=1`;
       const siteResponse = await fetch(searchUrl, {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
           'x-aether-api-key': seed.aether_api_key,
-          'x-no-account-id': 'Nothing to See Here',
           'x-account-id': deviceData.account_id_random || deviceData.account_id || ''
         },
         body: JSON.stringify({
-          search_query: {
-            and: [{ field: 'fqdn', op: 'eq', value: fqdn }]
-          },
-          limit: 1
+          and: [{ field: 'fqdn', op: 'eq', value: fqdn }]
         })
       });
 

src/main/file_handlers.ts

@@ -67,8 +67,7 @@ export function registerFileHandlers() {
         method: 'get', url, responseType: 'stream',
         headers: {
           'x-aether-api-key': api_key,
-          'x-account-id': account_id || '',
-          'x-no-account-id': 'Nothing to See Here'
+          'x-account-id': account_id || ''
         }
       });