Build SpacesOps StartOS package (v1.0.0:0)

Initial .s9pk for SpacesOps, targeting StartOS 0.4.0.x with SDK 1.5.1.

- Single managed daemon from spacesops/spacesops:v1.0.0 (x86_64 + aarch64),
  keeping the image entrypoint (/app/docker-entrypoint.sh node server.js).
  Forces PLATFORM_HOST=0.0.0.0 / PLATFORM_PORT=7264 so the StartOS proxy can
  reach the app. Single `ui` interface on 7264.
- Depends on the Spaces service (>=0.0.9:3) and auto-wires the spaced RPC creds:
  main.ts mounts the Spaces `main` volume read-only at /spaces-data, execs a
  read of its store.json inside the subcontainer, and injects SPACED_RPC_USER/
  PASSWORD + SPACED_RPC_URL=http://spaces.startos:7225. Throws to retry until
  Spaces is installed and seeded.
- Generates a Nostr operator keypair (nostr-tools, bundled by ncc) and a strong
  session secret in idempotent init tasks (.once() reads, allowWriteAfterConst
  merges). Actions: show-operator-credentials, import-operator-key,
  show-admin-credentials (surfaces the fixed admin/Whatever! login with a
  warning), configure-platform (optional relay/mode/CoinGecko/SUBSD).
- Install alert warns to install Spaces first and about the fixed admin
  credential. Backs up the `main` volume.
- Icon: icon.svg (source spacesops.svg). The `spaces` dependency uses
  assets/spaces-icon.png for its Marketplace metadata.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CONTRIBUTING.md

@@ -0,0 +1,58 @@
+# Contributing
+
+This repo packages [SpacesOps](https://git.spacesops.com/spacesops/spacesops)
+for StartOS.
+
+## Documentation — keep it in sync
+
+- **`README.md`** — what this package is and how it's built (image, volume,
+  interface, dependency, actions). For developers and AI assistants.
+- **`instructions.md`** — the user-facing instructions packed into the `.s9pk`
+  and shown on the **Instructions** tab in StartOS.
+- **`CONTRIBUTING.md`** — this file.
+
+**Any code change that warrants it must update `README.md` and `instructions.md`
+in the same change** — a new or renamed action, an added or removed volume /
+port / interface / dependency, a changed default, a new limitation, any altered
+user-visible behavior. A package that ships with a stale README or stale
+instructions is not done, even if the code is perfect. Content rules:
+[Writing READMEs](https://docs.start9.com/packaging/writing-readmes.html).
+
+## Building
+
+See the [StartOS Packaging Guide](https://docs.start9.com/packaging/) for
+environment setup, then:
+
+```bash
+npm ci            # install dependencies
+make              # build the .s9pk for x86_64 and aarch64
+```
+
+`npm run check` runs the TypeScript type-check; `npm run build` bundles
+`startos/` into `javascript/index.js` with `@vercel/ncc` (which inlines
+`nostr-tools`, used to derive and encode the operator keypair).
+
+## Updating the upstream version
+
+SpacesOps runs the `docker.io/spacesops/spacesops` image. To track a new
+upstream release:
+
+1. Bump `dockerTag` in `startos/manifest/index.ts` to
+   `spacesops/spacesops:<new version>`.
+2. Update `version` and `releaseNotes` in the file under `startos/versions/`,
+   renaming it to the new version string. A *new* version file is only needed
+   when the bump carries an `up`/`down` migration, or when you want the old
+   release notes preserved in git history — see
+   [Versions](https://docs.start9.com/packaging/versions.html).
+3. Rebuild (`make`), sideload the `.s9pk`, and confirm it starts and connects to
+   Spaces.
+4. Review `README.md` and `instructions.md` for anything the bump changed.
+
+## How auto-wiring to Spaces works
+
+`startos/main.ts` mounts the Spaces `main` volume read-only at `/spaces-data`,
+execs `cat /spaces-data/store.json` inside the subcontainer, and reads
+`spacedAuth.{username,password}` to populate `SPACED_RPC_USER` /
+`SPACED_RPC_PASSWORD`. If the file or credentials are missing, it throws so
+StartOS restarts the service until Spaces is ready. The Spaces dependency must
+expose its `spaces-api` interface and seed `spacedAuth` (Spaces `>=0.0.9:3`).