fix(onboard): 20-base.sh — popraw guard idempotencji swap→zram

Stary guard porównywał literał konfigu (SIZE=) zamiast sprawdzać efekt.
Ręcznie postawiony zram był pomijany (dpkg -l vs command -v) i config
był nadpisywany niepotrzebnie.

- Guard by effect: sudo swapon --show | grep /dev/zram + dphys nieaktywny
  → cała sekcja skip bez wchodzenia w substages
- Detekcja pakietu przez dpkg -l zram-tools (nie command -v zramswap — PATH)
- Config: PERCENT=50 (skaluje z RAM) zamiast SIZE=; printf '%s\n' | sudo tee
- Wszystkie weryfikacje zram przez sudo swapon --show (nie zramctl)
- Usuń parsowanie hardware.swap.mb (nieużywane po przejściu na PERCENT)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/onboard/steps/20-base.sh

@@ -27,8 +27,6 @@ fi
 # ── parse node.yaml ───────────────────────────────────────────────────────────
 SSH_USER=$(yaml_get    "$NODE_YAML" "ssh_user")
 TS_HOSTNAME=$(yaml_get "$NODE_YAML" "tailscale.hostname")
-_raw_mb=$(yaml_get   "$NODE_YAML" "hardware.swap.mb" 2>/dev/null || true)
-SWAP_MB="${_raw_mb:-2048}"
 
 [[ -z "$SSH_USER"    ]] && die "ssh_user not set in $NODE_YAML"
 [[ -z "$TS_HOSTNAME" ]] && die "tailscale.hostname not set in $NODE_YAML"
@@ -47,10 +45,20 @@ rprobe() {
 # ═══════════════════════════════════════════════════════════════════════════════
 # Stage 1 — swap→zram
 # ═══════════════════════════════════════════════════════════════════════════════
-step "[$STEP_NAME] 1/3 swap→zram (target: zram ${SWAP_MB} MB, algo=zstd)"
+step "[$STEP_NAME] 1/3 swap→zram (PERCENT=50, algo=zstd)"
 
-# Guard: is dphys-swapfile still active?
+# Guard by EFFECT: zram device present in swapon AND dphys-swapfile not active
-if rprobe 'systemctl is-active dphys-swapfile' >/dev/null 2>&1; then
+# → desired end-state already reached, skip the whole stage.
+_zram_active=0
+_dphys_active=0
+rprobe 'sudo swapon --show 2>/dev/null | grep -q /dev/zram' && _zram_active=1 || true
+rprobe 'systemctl is-active dphys-swapfile' >/dev/null 2>&1  && _dphys_active=1 || true
+
+if [[ "$_zram_active" -eq 1 && "$_dphys_active" -eq 0 ]]; then
+    log "zram already active, dphys-swapfile not active — skip"
+else
+    # Substage: disable dphys-swapfile if still active
+    if [[ "$_dphys_active" -eq 1 ]]; then
         log "dphys-swapfile active — disabling"
         rrun sudo dphys-swapfile swapoff
         rrun sudo systemctl disable --now dphys-swapfile
@@ -62,40 +70,27 @@ else
         log "dphys-swapfile not active — skip disable"
     fi
 
-# Guard: is zram-tools installed?
+    # Substage: install zram-tools if package not present
-if ! rprobe 'command -v zramswap' >/dev/null 2>&1; then
+    # Use dpkg -l rather than command -v: zramswap binary may not be on PATH over SSH
-    log "zram-tools not found — installing"
+    if ! rprobe 'dpkg -l zram-tools 2>/dev/null | grep -q "^ii"' 2>/dev/null; then
+        log "zram-tools not installed — installing"
         rrun sudo apt-get install -y zram-tools
     else
         log "zram-tools already installed"
     fi
 
-# Guard: is zram already active with the correct SIZE?
+    # Write config and (re)start zramswap
-_zram_ok=0
+    log "Writing /etc/default/zramswap (ALGO=zstd, PERCENT=50)"
-if rprobe 'swapon --show --noheadings 2>/dev/null | grep -q zram' 2>/dev/null; then
+    rrun bash -c "printf '%s\n' 'ALGO=zstd' 'PERCENT=50' | sudo tee /etc/default/zramswap > /dev/null"
-    _cfg_size=$(rprobe \
-        "grep -E '^[[:space:]]*SIZE=' /etc/default/zramswap 2>/dev/null \
-         | cut -d= -f2 | tr -d '\"[:space:]'" 2>/dev/null || echo "")
-    if [[ "$_cfg_size" == "$SWAP_MB" ]]; then
-        _zram_ok=1
-        log "zram active, SIZE=${SWAP_MB} MB — skip configure"
-    else
-        log "zram active but SIZE='${_cfg_size:-unset}' ≠ ${SWAP_MB} — reconfigure"
-    fi
-fi
-
-if [[ "$_zram_ok" -eq 0 ]]; then
-    log "Writing /etc/default/zramswap (ALGO=zstd, SIZE=${SWAP_MB})"
-    rrun sudo bash -c "printf 'ALGO=zstd\nSIZE=${SWAP_MB}\n' | tee /etc/default/zramswap > /dev/null"
     rrun sudo systemctl enable zramswap
     rrun sudo systemctl restart zramswap
 fi
 
 # Verify (skipped in dry-run — mutations may not have run)
 if [ "${DRY_RUN:-0}" != 1 ]; then
-    if rprobe 'swapon --show --noheadings 2>/dev/null | grep -q zram'; then
+    if rprobe 'sudo swapon --show 2>/dev/null | grep -q /dev/zram'; then
         log "Verify OK: zram swap active"
-        rprobe 'swapon --show; echo "---"; zramctl' || true
+        rprobe 'sudo swapon --show' || true
     else
         die "zram swap not active after setup — check: systemctl status zramswap on ${TS_HOSTNAME}"
     fi