perf(startup): prepare first-run node files in the background

On a first run or after an upgrade, Windows release builds wrote the
bundled Sapling params, asmap, node and miner (about 88 MB) in
App::init, before the first frame: 0.5-3 s of frozen blank window, 5-30 s
on a slow disk or under antivirus. Zip, AppImage and .app builds copied
the bundled files into the daemon dir and hashed the 51.5 MB of params on
the UI thread at the first node start, a 0.3-1.5 s freeze in the wizard
or the connect loop.

A stat-only check at startup decides whether anything is missing, stale
or unverified; a normal launch starts no thread and shows nothing.
Otherwise one background job extracts (Windows) or copies (Linux, macOS)
the files, then verifies the params once:

- The first frame paints at once. If the job takes longer than 0.4 s, a
  chip at the bottom shows "Preparing wallet files... N%", then
  "Verifying wallet files...".
- A node start on the UI thread while the job runs is deferred and
  replayed when it ends (never into a bootstrap download, a restart or a
  live connection); worker threads wait, and give up on quit. After an
  upgrade that ships a new miner, the node starts after the miner is
  written instead of before. Pool-miner starts and the miner version
  check wait too, so the old miner is never run or reported while it is
  being replaced.
- Each file goes to "<name>.partial", is flushed and renamed into place
  under one lock shared with the daemon start, the bundled-node
  reinstall and the miner extraction, and the job stops between 4 MB
  chunks at shutdown. An interrupted write used to leave a truncated
  binary that was trusted forever; a leftover .partial is now removed.

Other behaviour changes:

- Linux and macOS full-node builds copy the bundled node files (about
  77 MB) into the daemon dir at first launch, even if the wallet ends up
  on an external node; before, this happened at the first embedded start.
- Lite no longer writes the 53 MB of params and asmap it never reads.
- A disk-full or permission failure that leaves the node files unusable
  shows a warning; a miner blocked by antivirus alone does not.
- A corrupt or truncated param in a zip, AppImage or .app install is
  replaced from the bundle and verified again instead of trusted forever.
- Reinstalling the bundled node holds off the connect loop and a deferred
  start for its whole run (either could launch the old binary while the
  new one was written), and is refused while another restart is running.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/app_network.cpp

@@ -1647,6 +1647,7 @@ void App::switchToWallet(const std::string& walletFile, bool stopDaemonConfirmed
                 // stopDaemonForWalletSwitch() wait already ensured the old node's process is gone, so a valid
                 // wallet opens cleanly; a bad/corrupt wallet exits during init and we revert.
                 ok = shutting_down_ ? true : startEmbeddedDaemon();
+                if (shutting_down_) ok = true;   // a start aborted BY shutdown is not a failed switch (no revert)
                 // A missing/corrupt wallet makes dragonxd exit during init — confirm the process survived a
                 // moment; if not, the wallet is bad. (A valid launch keeps the process alive while it syncs.)
                 if (ok && !shutting_down_) {
@@ -3511,7 +3512,8 @@ void App::postPoolMinerJob(int threads, bool retargetOnly)
     daemon::XmrigManager::Config cfgCopy = cfg;
     const int target = cfg.threads;
     pool_threads_target_.store(target, std::memory_order_relaxed);
-    postMiningControl([this, cfgCopy, target, retargetOnly]() {
+    auto files = startup_files_;   // shared_ptr copy (set once in init()): the startup node-files job
+    postMiningControl([this, cfgCopy, target, retargetOnly, files]() {
         // A retarget is decided HERE, after every earlier start/stop ran: nothing happens unless a miner is
         // running now and at another count. So it never starts a miner the user stopped, and a restart's
         // stop window (isRunning() false on the UI thread) can't hide the running one.
@@ -3520,6 +3522,19 @@ void App::postPoolMinerJob(int threads, bool retargetOnly)
             if (xmrig_manager_->getRequestedThreads() == target) return;
         }
         if (xmrig_manager_->isRunning()) xmrig_manager_->stop(3000);
+        // The startup job may still be replacing the miner binary: never launch the old one under it. Waiting
+        // here (the mining-control thread) never blocks the UI; shutdown, or the control thread being stopped
+        // (shutdown()'s fallback path joins it before cancelling the job), ends the wait.
+        if (files) {
+            auto stopping = [this]() {
+                if (shutting_down_) return true;
+                std::lock_guard<std::mutex> lk(mining_ctl_mutex_);
+                return mining_ctl_stop_;
+            };
+            bool abort = false;
+            while (!abort && !files->waitUntilDone(100)) abort = stopping();
+            if (abort || shutting_down_ || files->endedCancelled()) { clearPoolThreadsTarget(target); return; }
+        }
         const bool ok = xmrig_manager_->start(cfgCopy);
         const std::string err = ok ? std::string() : xmrig_manager_->getLastError();
         if (!ok) clearPoolThreadsTarget(target);