install radicale and register officer-caldav on an existing server's next boot

Calendar and contacts became core in 9c309c5a. A FRESH install gets radicale
from machine-setup and officer-caldav from CORE_PROCESSES; an existing one gets
neither from a git pull, because a pull changes nothing outside the repository.
So without this, pulling that commit leaves /calendar mounted, rendering, and
talking to nothing — the silent half-working failure this codebase keeps
getting bitten by, and the same shape as the plugin permission collision fixed
in ee321f49.

Best-effort and AFTER serve(), never blocking: a held apt lock, an unreachable
mirror or a machine without passwordless sudo must not stop Officer starting.
Uses the existing os-deps machinery rather than a second spelling of "install a
package" — including `sudo -n`, which fails fast instead of hanging on a prompt
no one can answer under PM2. When it cannot install, it logs the exact command
to run by hand.

addCoreProcess is new and deliberately narrow. The platform normally never
writes a core entry — it does not know the core list, and duplicating
CORE_PROCESSES here would be a second copy to drift. The exception is exactly
this: a commit that MOVES something into the core set, which an existing
install has no other way to learn about.

Verified on this machine rather than assumed: radicale was absent, the guard
installed it (3.1.8), and a second run reported `present` and wrote nothing.
The install path is not unit-tested on purpose — a test that really ran
apt-get would modify the machine running it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/server.tsx

@@ -4,6 +4,7 @@ import { serve } from 'bun';
 import { join } from 'node:path';
 import { honoServer, PROTECTED_API_PREFIXES, UNPROTECTED_API_PREFIXES } from './servers/hono';
 import { assertPermissionTotality } from './servers/permissions/totality';
+import { bootstrapCaldav } from './servers/caldav-bootstrap';
 import { refreshPluginMounts, snapshotPlugins } from './servers/plugins/mount';
 import { listPluginRootClaims } from './servers/plugins/public-paths';
 import { generatePluginsModule, rebuildFrontend, BUILD_DIR, SHELL_FILE } from './servers/plugins/generate';
@@ -551,4 +552,11 @@ void (async () => {
 // the provider names — and now lives in `plugins/music/cliamp/`, parked rather than working. Bringing it
 // back means a plugin owning a websocket, which is a platform gap, not a music one.
 
+// Calendar and contacts became CORE on 2026-08-19, having been an app-store entry since 2026-08-13.
+// A fresh install gets radicale and the officer-caldav entry from setup; an EXISTING one gets neither
+// from a `git pull`, so it would come up with /calendar mounted and nothing behind it. Best-effort,
+// after serve(), never blocking: a held apt lock or a machine without passwordless sudo must not stop
+// Officer from starting, and when it cannot install it says what to run instead.
+void bootstrapCaldav();
+
 // Pi check/install is handled by bootstrap.ts (imported above)