onboard-spoke.sh: remove comment syntax from manual key instructions

setup-spoke.sh, setup-network.sh: fix check_permissions false alarm on pubkeys, TUNNEL_UP boolean comparison, DNS_YAML trailing newline, backup file guard

spoke/setup-network.sh

@@ -78,7 +78,10 @@ DNS_YAML=""
 IFS=',' read -ra DNS_LIST <<< "$DNS_INPUT"
 for DNS in "${DNS_LIST[@]}"; do
     DNS=$(echo "$DNS" | tr -d ' ')
-    DNS_YAML="${DNS_YAML}          - ${DNS}"$'\n'
+    if [ -n "$DNS_YAML" ]; then
+        DNS_YAML="${DNS_YAML}"$'\n'
+    fi
+    DNS_YAML="${DNS_YAML}          - ${DNS}"
 done
 
 info "Current netplan configs:"
@@ -140,7 +143,8 @@ network:
           via: ${GATEWAY}
       nameservers:
         addresses:
-${DNS_YAML}      access-points:
+${DNS_YAML}
+      access-points:
         "${WIFI_SSID}":
           password: "${WIFI_PASS}"
 NETEOF
@@ -182,7 +186,7 @@ if $CONNECTED; then
     info "Network connectivity confirmed — config applied permanently."
 else
     warn "No network connectivity detected after 30 seconds — reverting to backup config."
-    if [ -f "$BACKUP_FILE" ]; then
+    if [ -n "$BACKUP_FILE" ] && [ -f "$BACKUP_FILE" ]; then
         cp "$BACKUP_FILE" "$NETPLAN_FILE"
         netplan apply
         die "Config reverted to backup. Check your settings and try again."