Merge 6d1d67d249 into 2b9a060561

Caught during 2.6.0 live deploy on gk2: `debian/rules` had install lines
for `sbin/secubox-toolbox-db-tune` (override_dh_strip) and a few wg-
phase scripts but NEVER for `sbin/secubox-toolbox-mitm-wg-launch`. The
existing launcher on gk2 was a leftover from an older deploy and dpkg
upgrades silently kept the file static — which masked the Phase 11.A
addon-chain edit (social_graph was added in source but never reached
the live launcher).

  - debian/rules: explicit install lines for the three sbin helpers
    (lxc-provision, mitm-wg-launch, wg-provision).  These were either
    ad-hoc-installed before or relied on the operator copying them
    by hand.
  - sbin/secubox-toolbox-mitm-wg-launch: chmod 0755 (was 0664).
  - sbin/secubox-toolbox-wg-restore: chmod 0755 (was 0664).

Closes a source-first regression caught by [feedback_source_first_always].

packages/secubox-toolbox/debian/rules

@@ -23,6 +23,13 @@ override_dh_auto_install:
 	install -d debian/secubox-toolbox/usr/sbin
 	install -m 0755 scripts/toolbox-up debian/secubox-toolbox/usr/sbin/
 	install -m 0755 scripts/ca-init    debian/secubox-toolbox/usr/sbin/secubox-toolbox-ca-init
+	# sbin/ helpers (Phase 5 LXC, Phase 6 R3 WG, Phase 9 fanout, Phase 11 social).
+	# Pre-2.6.0 only db-tune + lxc-provision shipped — the mitm-wg-launch
+	# wrapper had to be hand-installed on the board.  This block ships them
+	# all consistently so the .deb is self-contained.
+	install -m 0755 sbin/secubox-toolbox-lxc-provision   debian/secubox-toolbox/usr/sbin/
+	install -m 0755 sbin/secubox-toolbox-mitm-wg-launch  debian/secubox-toolbox/usr/sbin/
+	install -m 0755 sbin/secubox-toolbox-wg-provision    debian/secubox-toolbox/usr/sbin/
 
 override_dh_installsystemd:
 	# Install the secondary unit manually (dh_installsystemd expects 1 unit/pkg).