fix(installer): build + ship libkrun on MacOS - #655

The sdd-spec commit for this branch bundled a stale revert of the
libkrun macOS release job and its stage-release entry (both landed in
#655) alongside the spec file. This PR is spec-only; restore the two
files to match main so the release flow is unchanged.

Refs: #655

…-aware) (#658)

* docs(spec-vm-ext4-volume): spec for per-VM writable ext4 volume

* ci(release): restore libkrun macOS build dropped by spec-PR leak

The sdd-spec commit for this branch bundled a stale revert of the
libkrun macOS release job and its stage-release entry (both landed in
#655) alongside the spec file. This PR is spec-only; restore the two
files to match main so the release flow is unchanged.

Refs: #655

* docs(spec-vm-ext4-volume): address CodeRabbit review

- R2.5: emit MOUNT_FAILED unconditionally on any /dev/vdb mount failure;
  drop the unreachable "inspect sessions/ after a failed mount" branch and
  move the fatal-vs-recoverable decision host-side.
- R3.3: replace non-empty worktree via renameat2(RENAME_EXCHANGE) instead
  of rename(2), which fails with ENOTEMPTY on a non-empty destination.
- R3.4: normalize the ProviderIndex schema — map keyed by SessionId, with
  VolumeEntry holding only { image_path, vm_id } and not repeating the id.

* docs(spec-vm-ext4-volume): add sparsity + disk-sync proof gates

Hold the RAW two-disk topology (Phase 1 scope per #583) and answer the
review concerns with measurement rather than assertion.

- R1.9: MINVMD_DISK_SYNC / MINVMD_DISK_DIRECT_IO tunables; stop
  hardcoding sync_mode/direct_io in R1.4 so the durability/throughput
  posture is measurable and per-platform tunable.
- Proof Artifact 3 (decision gate): verify allocate-on-write sparsity
  and characterize reclaim-on-discard on APFS; a failing reclaim result
  is the documented trigger to reopen qcow2 (#647).
- Proof Artifact 4: time a build workload across the sync/direct_io
  matrix so the default is chosen from data.
- Design Considerations: why RAW is held against the qcow2 data-disk and
  qcow2 backing-file-overlay alternatives (VMM gate, crash surface,
  Phase-3 topology).
- Open Question 4: durability granularity vs. the single shared volume.

Refs: #583

* docs(spec-vm-ext4-volume): record macOS proof results + require Linux/KVM leg

Fold the executed proof artifacts into the spec and extend them to cover
Linux hosts, since two axes are host-dependent.

- Proof Artifacts 3 & 4: record the macOS/HVF/APFS results (allocate-on-
  write 2 GiB exact; BLKDISCARD reclaim to 0; sync sweep none/relaxed/full
  = 4.7/3.1/0.25 GB/s) and add a required Linux/KVM leg (runs in CI; no
  /dev/kvm on a macOS host).
- New Design Consideration "Platform differences": sync_mode RELAXED is
  identical to FULL on Linux (macOS drive-flush relaxation does not apply),
  so the three-point curve collapses to two; reclaim depends on the Linux
  host FS + KVM virtio-blk backend and must be verified, not inferred.
- Non-Goals: Phase-2 reflink needs xfs/btrfs on Linux (ext4 has none),
  unlike APFS clonefile — a Linux host-FS prerequisite (#647).
- Correct R1.1/R1.2/R1.9: krun_add_disk3 sync_mode is a u32 tri-state
  (KRUN_SYNC_{NONE,RELAXED,FULL}), not a bool; default RELAXED.
- Verification matrix + Open Question 4 updated to the per-host split.

Refs: #583

* docs(spec-vm-ext4-volume): drop R1.8 (guest RAM reduction) from scope

Reducing the RAM stop-gap when the cache leaves the tmpfs is only safe once a
failed volume mount is fatal (no silent tmpfs fallback) and the floor is
measured against real in-VM build memory pressure. Neither is settled by this
spec, so the reduction moves to a separate memory-pressure spec. Recorded as a
Non-Goal; R1.9 is left un-renumbered.

Refs: #583

* docs(spec-vm-ext4-volume): make R1.3 a plain provisioning fn, not a trait

Drop the single-use VolumeProvisioner trait / BlankRawProvisioner from the spec
to match the implementation (code review: no abstraction for single-use code).
R1.3 now specifies `ensure_sparse_raw(path, size)` provisioning at the literal
path plus `resolve_data_volume_path()`; R1.4 reflects attach-on-every-boot (not
env-gated) and the relaxed sync default. Rewords the Intro overview, the Phase-2
"seam" non-goal, affected areas, and the volume-size open question accordingly.

Refs: #583

* docs(spec-vm-ext4-volume): note periodic-fstrim reclamation follow-up

Record Tom's review suggestion (#658): the guest does not proactively issue
TRIM, so the RAW host image only shrinks on an explicit discard; if host-side
growth becomes a problem, a periodic guest fstrim (e.g. a cron) reclaims freed
blocks. ext4 reuses its own free blocks in place regardless. Captured as a
Non-Goal / follow-up.

Refs: #583

---------

Co-authored-by: gominimal-aw-bot[bot] <281738952+gominimal-aw-bot[bot]@users.noreply.github.com>
Co-authored-by: Norrie Taylor <norrie@minimal.dev>