Rebuild the shell server from a pristine installation it cannot break

On 6 Nov a visitor deleted the whole MSYS2 installation, the locked
/etc/passwd included, and the site was down for a week: the cleanup job
repaired the runtime with pacman, which was gone too, and never tried to
start the server again because a port-22 query without results counted as
a failed query.

The installer now builds a pristine installation from the official base
archive (hash pinned) and the site's packages in the administrators'
folder. Everything the SYSTEM server trusts comes from there and is kept
in place and locked by the cleanup job: opt/kik, the runtime, passwd,
group, nsswitch.conf, fstab, fstab.d and etc/ssh. The user gets modify
rather than full control, so locked files can no longer be deleted, and
the folders leading to them cannot be renamed. When pacman is gone the
job copies the missing files back from the pristine installation.

Nothing that runs as SYSTEM or Administrator runs a file the user can
write any more: the job ran /usr/bin/pacman.exe as SYSTEM, the installer
ran ldd and pacman from the installation, the Administrator's shell was
a cmdshell.exe in /usr/local/bin, and the Administrator's sessions
searched /usr/bin for programs. The Administrator's shell is PowerShell
now, and deploy.sh speaks it.

server/scripts/rdp.sh opens a headless remote desktop session for when
SSH is down. The shell finds the CLANG64 programs and runs helix through
winpty.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

server/scripts/rdp.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Opens a remote desktop session to the shell server as Administrator, for when SSH is down. The session runs
+# headless on a virtual display, so it can be driven from the command line:
+#
+#   server/scripts/rdp.sh         opens the session (and closes one that is still open)
+#   server/scripts/rdp.sh stop    closes it
+#
+# - look:   DISPLAY=:73 import -window root shot.png
+# - type:   printf 'text' > $XDG_RUNTIME_DIR/kik-rdp/keys, and special keys with DISPLAY=:73 xdotool key Return
+# - files:  $XDG_RUNTIME_DIR/kik-rdp/share is \\tsclient\kik in the session
+#
+# The password is read from .password.txt in the root of the repository and handed to the client on stdin, so it
+# shows up neither on a command line nor in a log.
+set -euo pipefail
+
+repo=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+dir=${XDG_RUNTIME_DIR:-/tmp}/kik-rdp
+display=:73
+
+for pid in "$dir"/*.pid; do
+    [ -e "$pid" ] || continue
+    kill "$(cat "$pid")" 2>/dev/null || true
+    rm -f "$pid"
+done
+if [ "${1:-}" = stop ]; then exit; fi
+
+bin() { echo "$(nix build --no-link --print-out-paths "nixpkgs#$1")/bin/$2"; }
+mkdir -p "$dir/share"
+# the client creates the pipe itself and refuses one that is left over
+rm -f "$dir/keys"
+
+setsid "$(bin xorg.xvfb Xvfb)" "$display" -screen 0 1280x800x24 -nolisten tcp > "$dir/xvfb.log" 2>&1 < /dev/null &
+echo $! > "$dir/xvfb.pid"
+sleep 2
+
+{
+    printf '%s\n' /v:nowhere.wirs.ing /u:Administrator /cert:tofu /size:1280x800 +auto-reconnect \
+        "/drive:kik,$dir/share" "/kbd:unicode:on,pipe:$dir/keys" /log-level:WARN
+    printf '/p:%s\n' "$(cat "$repo/.password.txt")"
+} | DISPLAY=$display setsid "$(bin freerdp xfreerdp)" /args-from:stdin > "$dir/xfreerdp.log" 2>&1 &
+echo $! > "$dir/xfreerdp.pid"
+
+sleep 15
+if kill -0 "$(cat "$dir/xfreerdp.pid")" 2>/dev/null; then
+    printf 'The session is open on display %s; %s/share is \\\\tsclient\\kik in it.\n' "$display" "$dir"
+else
+    echo 'The client ended:' >&2
+    tail -5 "$dir/xfreerdp.log" >&2
+    exit 1
+fi