Remove ManagerPanel remote fallbacks: bundle-only install

Panel, udp-custom, udpgw and falconproxy are now installed exclusively from
/opt/firewallfalcon-bundle. The raw.githubusercontent and GitHub releases
fallbacks are gone; a missing bundle file is a hard error via the new
ff_require_bundle_file helper.

- menu.sh: drop PANEL_REPO_BASE and every remote download branch
- menu.sh: falconproxy no longer queries api.github.com for releases
- menu.sh: ARM udpgw can use an optional bundled udpgw-linux-arm64
  (the bundled udpgw is an x86-64 build), otherwise it builds from source
- install.sh: verify the staged bundle and mark binaries executable
- README: document the change and the remaining third-party dependencies

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

install.sh

@@ -62,6 +62,25 @@ cp -r "$SCRIPT_DIR/release" "$BUNDLE_INSTALL_DIR/release"
 # Drop UPX packed originals from the bundle (unpacked binaries are used)
 rm -f "$BUNDLE_INSTALL_DIR"/udp/*.upxbackup
 
+# Verify the staged bundle: the menu has no remote fallback, so a missing file
+# here would surface later as a failed module install.
+for staged in \
+    "$BUNDLE_INSTALL_DIR/panel/panel.py" \
+    "$BUNDLE_INSTALL_DIR/panel/index.html" \
+    "$BUNDLE_INSTALL_DIR/udp/udp-custom-linux-amd64" \
+    "$BUNDLE_INSTALL_DIR/udp/udp-custom-linux-arm" \
+    "$BUNDLE_INSTALL_DIR/udp/udpgw" \
+    "$BUNDLE_INSTALL_DIR/release/falconproxy" \
+    "$BUNDLE_INSTALL_DIR/release/falconproxyarm"
+do
+    if [[ ! -s "$staged" ]]; then
+        echo "Error: Bundle staging failed, missing or empty: $staged"
+        exit 1
+    fi
+done
+chmod +x "$BUNDLE_INSTALL_DIR"/udp/udp-custom-linux-* "$BUNDLE_INSTALL_DIR"/udp/udpgw* \
+         "$BUNDLE_INSTALL_DIR"/release/falconproxy* 2>/dev/null || true
+
 # Install menu from the local copy
 cp "$SCRIPT_DIR/menu.sh" /usr/local/bin/menu
 chmod +x /usr/local/bin/menu