onboard-spoke.sh: remove comment syntax from manual key instructions

setup-spoke.sh, setup-network.sh: fix check_permissions false alarm on pubkeys, TUNNEL_UP boolean comparison, DNS_YAML trailing newline, backup file guard

spoke/setup-spoke.sh

@@ -68,7 +68,7 @@ check_permissions() {
     fi
     local world="${perms: -1}"
     local group="${perms: -2:1}"
-    if [ "$world" != "0" ] || [ "$group" != "0" ]; then
+    if [ "$world" != "0" ]; then
         warn "UNSAFE PERMISSIONS on $label ($file): $perms — should be 600 or 400"
         warn "Fixing permissions automatically..."
         chmod 600 "$file"
@@ -340,7 +340,7 @@ docker build \
     -t spoke-autossh .
 
 header "Starting Containers"
-TUNNEL_UP=false
+TUNNEL_UP="false"
 for ATTEMPT in 1 2 3; do
     docker compose up -d
     info "Waiting for tunnel to establish..."
@@ -359,12 +359,12 @@ for ATTEMPT in 1 2 3; do
             warn "Next port also in use. Waiting before retry..."
         fi
     else
-        TUNNEL_UP=true
+        TUNNEL_UP="true"
         break
     fi
 done
 
-if $TUNNEL_UP; then
+if [ "$TUNNEL_UP" = "true" ]; then
     info "Tunnel is up on port $TUNNEL_PORT."
 else
     die "Tunnel failed after 3 attempts. Run: docker compose down && docker compose up -d"