[codex] make installer runtime-first

[i386]

Summary

Makes install.sh the runtime-first installer for releases that publish native-runtimes.json and native runtime archives.

install.sh defaults to the prerelease channel, requires a native runtime manifest, installs the mesh binary bundle, then runs mesh-llm runtime install --manifest and prunes inactive runtimes. install-runtime.sh remains as a compatibility wrapper that delegates to install.sh, so the older runtime-installer URL still works without duplicate logic.

Dynamic-native-runtime release binaries also self-heal on startup: if an older updater installs a 0.72+ binary without installing the matching native runtime cache entry, local-serving startup downloads the release manifest, installs the recommended native runtime, and loads it before model startup. Client-only runs without local models skip that download.

Release CI now publishes native runtime archives from the supported release target jobs. Each meshllm-native-runtime-* archive contains both the Skippy/llama runtime libraries and the SDK FFI libraries in runtime.sdk; the old separate meshllm-native-* SDK runtime tarballs and crate wrapper packaging scripts were removed.

Behavior

• install.sh defaults to --pre-release because runtime releases currently live there.
• install.sh --stable is supported, but fails clearly while stable lacks runtime release assets.
• Platform bundles are preferred when present.
• mesh-bundle.tar.gz is used as the fallback runtime binary bundle.
• A binary without runtime install support is rejected by the installer.
• install-runtime.sh delegates to install.sh for backward compatibility.
• mesh-llm update from pre-runtime binaries can hand off to a 0.72+ binary, and the new binary installs its native runtime on first local-serving startup.
• SDK consumers resolve the same meshllm-native-runtime-* artifacts as the installer; CUDA/ROCm/Vulkan/Windows selection is driven by native-runtimes.json instead of a separate SDK artifact lane.

Release Assets

The next release publishes versioned mesh binary bundles plus native-runtimes.json and these runtime archives when the corresponding jobs run:

• meshllm-native-runtime-darwin-aarch64-metal.tar.gz
• meshllm-native-runtime-linux-x86_64-cpu.tar.gz
• meshllm-native-runtime-linux-aarch64-cpu.tar.gz
• meshllm-native-runtime-linux-x86_64-cuda12.tar.gz
• meshllm-native-runtime-linux-x86_64-cuda13.tar.gz
• meshllm-native-runtime-linux-aarch64-cuda12.tar.gz
• meshllm-native-runtime-linux-aarch64-cuda13.tar.gz
• meshllm-native-runtime-linux-x86_64-rocm.tar.gz
• meshllm-native-runtime-linux-x86_64-vulkan.tar.gz
• meshllm-native-runtime-windows-x86_64-cpu.tar.gz
• meshllm-native-runtime-windows-x86_64-cuda12.tar.gz
• meshllm-native-runtime-windows-x86_64-rocm.tar.gz
• meshllm-native-runtime-windows-x86_64-vulkan.tar.gz

No separate meshllm-native-* SDK runtime archives are published.

Validation

• python3 -m unittest scripts.tests.test_install_sh scripts.tests.test_install_runtime_sh
• bash -n install.sh && bash -n install-runtime.sh
• bash -n scripts/package-release.sh scripts/package-native-runtime.sh scripts/generate-native-runtime-release-manifest.sh
• bash -n scripts/package-native-runtime.sh scripts/verify-native-runtime-package.sh scripts/ci-prepare-native-runtime.sh scripts/ci-kotlin-sdk-smoke.sh
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml")'
• cargo fmt --all -- --check
• cargo test -p mesh-llm-native-runtime --lib
• cargo check -p mesh-llm-runtime-install
• cargo run -p xtask -- repo-consistency release-targets
• cargo run -p xtask -- repo-consistency ci-crate-lists
• cargo check -p mesh-llm --features dynamic-native-runtime
• cargo test -p mesh-llm-host-runtime --features dynamic-native-runtime native_runtime_prepare --lib
• cargo test -p mesh-llm-host-runtime --features dynamic-native-runtime prepares_native_runtime --lib
• cargo clippy -p mesh-llm --features dynamic-native-runtime --all-targets -- -D warnings
• cargo check -p mesh-llm
• cargo clippy -p mesh-llm --all-targets -- -D warnings

PowerShell syntax checking for scripts/package-release.ps1 was not run locally because pwsh is not installed in this worktree environment.