Hotspot: ship dnsmasq-base; NetworkManager requires it for hotspot DHCP.

The amd64 ISO is built with --apt-recommends false, so network-manager's
Recommends (including dnsmasq-base) were never installed. NetworkManager's
shared/hotspot mode spawns dnsmasq for DHCP, so the hotspot failed to
activate on every ISO install. Add it to the package list (which
install_debian_12.sh also installs from) and as an idempotent upgrade.sh
step so existing installs are fixed on their next upgrade.

Also add iw and rfkill, the standard WiFi diagnostic tools.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

debian-live-config/config/package-lists/wrolpi.list.chroot

@@ -13,6 +13,7 @@ chromium
 chromium-driver
 cpufrequtils
 curl
+dnsmasq-base
 dosfstools
 ethtool
 exfat-fuse
@@ -36,6 +37,7 @@ hostapd
 htop
 iotop
 iperf3
+iw
 kiwix
 kiwix-tools
 libboost-all-dev
@@ -76,6 +78,7 @@ python3-doc
 python3-full
 python3-pip
 python3-venv
+rfkill
 rsync
 samba
 smartmontools

scripts/upgrade.sh

@@ -163,6 +163,16 @@ if ! command -v gnome-disks &>/dev/null; then
     -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold gnome-disk-utility
 fi
 
+# Install dnsmasq-base if not already installed (NetworkManager needs it for the hotspot's
+# DHCP; it is only a Recommends of network-manager, so ISOs built with --apt-recommends
+# false shipped without it).  iw and rfkill are WiFi diagnostic tools.
+if ! command -v dnsmasq &>/dev/null; then
+  echo "Installing dnsmasq-base, iw, rfkill..."
+  apt-get update
+  DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold dnsmasq-base iw rfkill
+fi
+
 # Clean up stale landing page (Controller now serves port 80 directly).
 rm -f /var/www/landing.html