[Dimoshka]

Summary

Fixes two related pinning defects:

1. Every runtime download URL 404s. RuntimeAsset.url was built from the install tag v0.8.0, but that release only carries nightly-tag.txt; the archives live on the b11960 nightly build. The URL now uses a separate assetTag, so downloads point at b11960 while the install identity stays v0.8.0.
2. tool/build_llama_cpp.sh trusted the tag. For the pinned tag it now reads the commit from LlamaVersionPin, checks the checkout out at that commit (fetching it when needed), hard-fails when it cannot, and prints the resolved commit.

Refs #37

Evidence

Verified with curl -sSIL before the change:

URL	Result
.../releases/download/v0.8.0/llama-b11960-bin-ubuntu-x64.tar.gz	404
.../releases/download/b11960/llama-b11960-bin-ubuntu-x64.tar.gz	302 → 200, 22686210 bytes (pinned size)
.../releases/download/v0.8.0/llama-b11960-bin-win-cpu-x64.zip	404
.../releases/download/b11960/llama-b11960-bin-win-cpu-x64.zip	302 → 200, 24407745 bytes
.../releases/download/v0.8.0/llama-b11960-bin-macos-arm64.tar.gz	404
.../releases/download/b11960/llama-b11960-bin-macos-arm64.tar.gz	302 → 200, 16465074 bytes
.../releases/download/v0.8.0/nightly-tag.txt	302 → 200, 7 bytes
.../releases/download/b11960/nightly-tag.txt	404

The Linux CPU asset now resolves to:

https://github.com/ggml-org/llama.cpp/releases/download/b11960/llama-b11960-bin-ubuntu-x64.tar.gz

Design note

RuntimeAsset.tag is the install identity: manifests, RuntimeAttestation.verify (manifest.tag == release.tag), the CLI runtime install --tag default and the <config>/runtime/<tag>/<backend> layout all depend on v0.8.0. It is unchanged.

The new RuntimeAsset.assetTag is the download release — the GitHub release that physically holds the archive. It is nullable (null means "same as tag"), so every other RuntimeAsset constructor and test fake keeps working unchanged. url uses ${assetTag ?? tag}. RuntimeRelease.v080 passes assetTag: 'b11960' to all 12 assets; release.tag, asset.tag and release.build are untouched.

tool/build_llama_cpp.sh gates commit verification on the pinned tag only. Other tags keep the existing "local experiment" path and version warning; the resolved commit is printed either way so a mismatch is diagnosable.

Tests

Core runtime_release_test.dart:

• every URL points at .../download/b11960/ and still ends with its asset name;
• every asset keeps tag == 'v0.8.0' with assetTag == 'b11960';
• no URL contains /download/v0.8.0/;
• the exact Linux CPU URL is asserted offline (no network test added).

Downloader and installer tests route fakes by asset.url, so they exercise the new URL transparently and still pass.

Gate

dart run melos run gen twice (no drift), gen:catalog:check (362 parameters, clean), melos run check and melos run format:check all green:

• core: 803 passed, 1 skipped
• CLI: 233 passed
• app: 166 passed
• total: 1202 passed (3 new tests over the previous 1199)

bash -n tool/build_llama_cpp.sh is clean.