v0.4.66: ship smbclient in the runtime image

v0.4.65 added the SmbShareManager but the Dockerfile only installed
the `samba` package — in Debian 12 that ships the SERVER (smbd) only,
not the `smbclient` CLI the new manager shells out to. Every "Add
share" attempt surfaced:

    could not exec smbclient: No such file or directory (os error 2)

Fix is two lines: add `smbclient` to the runtime apt install, drop
the leftover `nfs-common` (no kernel-mount NFS anymore so the helpers
aren't needed).

While in the area, harden the manager so future stripped-down runtime
images get a useful error instead of a bare exec failure:

- `list_isos` and `stream_iso` both detect `ErrorKind::NotFound` on
  spawn and emit "smbclient binary not found on $PATH".
- `hint_for` translates the missing-binary pattern into an actionable
  hint: "pull OpenPXE v0.4.66+ or add the Debian `smbclient` package
  to your runtime stage." So even on a custom build the UI still
  surfaces a clear remediation.

Tests: 150 passing (+1 for the new hint). clippy clean.

The image is still ~98 MB — `smbclient` adds <1 MB on top of the
already-installed samba server.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

deploy/docker/Dockerfile

@@ -81,23 +81,30 @@ FROM debian:12-slim AS runtime
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
         ca-certificates libcap2-bin tini gosu iproute2 \
-        wimtools samba nfs-common \
+        wimtools samba smbclient \
  && rm -rf /var/lib/apt/lists/* \
  && useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
  && mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
  && chown -R openpxe:openpxe /var/lib/openpxe
 # v0.4.5: the openpxe binary itself is now built against musl and is
 # fully static — no glibc dependency. The runtime stage still ships
-# Debian slim because OpenPXE shells out to the four packages below for
+# Debian slim because OpenPXE shells out to the packages below for
 # functionality we deliberately don't reimplement in-process:
+#
 #   wimtools   - `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
 #   samba      - `smbd` serves extracted Windows install media on :445 so
 #                WinPE can `net use`. Guest read-only, scoped to
-#                /var/lib/openpxe/smb.
-#   nfs-common - `mount.nfs` / `mount.nfs4` for the Storage tab's NFS
-#                share manager. Mount requires CAP_SYS_ADMIN; without it
-#                mount(2) returns EPERM and the manager surfaces a clear
-#                error in the UI.
+#                /var/lib/openpxe/smb. This package provides the SERVER
+#                side only; the client CLI is a separate package below.
+#   smbclient  - v0.4.66: Samba's `smbclient` userspace CLI, used by
+#                the Storage tab's SMB shares manager to list and stream
+#                ISOs from remote SMB servers without ever mounting them
+#                in the kernel. In Debian 12 `smbclient` is NOT pulled
+#                in by the `samba` package — they're siblings, not
+#                parent/child. v0.4.65 shipped without this line and
+#                every "Add share" attempt surfaced
+#                `could not exec smbclient: No such file or directory`
+#                until this landed.
 #   iproute2   - `ip addr` / `ip route` for the auto-detected Network
 #                tab fields (NIC name, subnet mask, default gateway).
 #                Tiny, always available; we don't pull in netlink crates
@@ -105,8 +112,13 @@ RUN apt-get update \
 #   gosu       - drops privileges cleanly from root after the entrypoint
 #                fixes bind-mount ownership (common OpenShift/Docker UX
 #                issue).
+#
+# v0.4.65 dropped `nfs-common` — kernel-mount NFS is gone. The SMB
+# shares replacement uses userspace `smbclient` and needs no kernel
+# helpers.
+#
 # A future "openpxe-static" variant could drop everything except the
-# binary onto distroless once we move the Windows + NFS legs to
+# binary onto distroless once we move the Windows + SMB legs to
 # in-process Rust crates.
 
 COPY --from=build /openpxe /usr/local/bin/openpxe