Git-less install path so embedders inherit bundling in single-process / no-git runtimes

[melvincarvalho]

Problem

jspod install (and the first-run bootstrap that seeds the default bundle) installs each app by git clone + git push to the pod's git-receive endpoint:

• index.js runInstall() → spawnSync('git', ['clone', …]) then a git push to <pod>/public/apps/<name> (requires the pod started with --git).

That needs a git binary, child_process spawning, and the git HTTP backend. None of those exist on nodejs-mobile (the Android app, js-pod/android) — no git, no forking. So:

• The in-process start() added in Embeddable in-process start (no spawn) so jspod can wrap JSS on mobile/single-process runtimes #58 / feat(start): in-process mode (createServer, no jss spawn) — embeddable jspod #59 boots the server fine, but its bootstrap can't install apps there (the spawn error handler just fires harmlessly).
• The Android app had to reimplement bundling itself: fetch each app's files from jsDelivr (the CDN mirror of the repo's gh-pages) and write them to disk.

Ask

Add a git-less install path to jspod so embedders inherit bundling instead of reimplementing it:

• Resolve a bundle/app to its files over HTTP — e.g. the jsDelivr per-file tree API (https://data.jsdelivr.com/v1/package/gh/<org>/<repo>@<ref>) + https://cdn.jsdelivr.net/gh/<org>/<repo>@<ref>/<file> — instead of git clone.
• Write the files into the pod (directly to <root>/public/apps/<name>/ on disk for in-process, or PUT via the Solid HTTP API with the IdP token for remote).
• Expose it as a callable function (not just the CLI) and wire it into the in-process bootstrap (afterReady), so first-run default bundle install works in git-less runtimes.
• Keep the git path as the default where git is available; pick git-less when git/spawn aren't (flag or auto-detect).

Payoff

• Completes Embeddable in-process start (no spawn) so jspod can wrap JSS on mobile/single-process runtimes #58: in-process start() handles the server; this handles the apps.
• The Android app drops its hand-rolled jsDelivr bootstrap and just uses jspod → onboarding + bundling + version tracking all inherited.
• Benefits any git-less embedder (Electron sandboxes, locked-down hosts).

Refs

• Builds on Embeddable in-process start (no spawn) so jspod can wrap JSS on mobile/single-process runtimes #58 (embeddable in-process start) / PR feat(start): in-process mode (createServer, no jss spawn) — embeddable jspod #59.
• Android app's current jsDelivr bootstrap: js-pod/android (nodejs-assets/nodejs-project/main.js seedAppsOnFirstRun / installApp) is a working reference implementation to port.

[melvincarvalho]

Scope note: the bundled apps/ set is the offline-first path and already works — apps/ ships in the package and seedPodFiles() copies it into the pod on first run with no git and no network. It carried pilot; #61 adds profile + home. Verified the in-process start() (#59) installs the bundled set offline (the test pod got pilot with zero network).

So this issue (#60, git-less network install via jsDelivr) is not the primary path for the common case — it's for arbitrary/extra apps and updating without a jspod release. The curated mobile default (pilot/profile/home) is covered offline by the bundle; #60 layers on top for everything beyond it.