CI: land verified app-host layer format on current peer stack

[teamleaderleo]

Current-stack replacement for #13564 / the format foundation from #13201.

Base: #13575 (ci-peer-artifact-source-refresh).

This PR contains only the verified layer format and exact layer transport foundation:

• canonical four-layer manifest: app-cli, runtime, tests, diagnostics;
• Apple Archive/LZFSE pack/restore helper;
• exact provider-index identity and bounded ZIP/layer validation;
• path/link/mode/xattr/content validation;
• atomic no-replace local assembly;
• focused layer transport/assembler/native archive tests;
• current documentation, with retired warning-log receipt coupling removed.

It does not yet change normal consumers. #13567's current-stack replacement follows with selective app-cli + runtime + tests wiring and aggregate rollback.

The diff is ahead of the current peer branch with no behind commits.

---

Summary by cubic

Adds the verified app-host layer format and exact layer transport to the current CI stack. Normal consumers are unchanged; the layered path is opt-in via in-repo labels or a manual full-suite run, with the legacy aggregate artifact remaining the default.

• Adds a canonical four-layer manifest (app-cli, runtime, tests, diagnostics) with Apple Archive/LZFSE pack and restore helpers.
• Pins provider artifact IDs, digests, run identity, and expiry; consumers verify origin, ZIP members, and inner archive bytes before assembly.
• Restore validates paths, symlinks, modes, extended attributes, and content, then atomically publishes to an absent task-owned directory.
• Any failure leaves the existing aggregate destination untouched and falls back to the legacy path.
• Adds transport, assembler, and archive round-trip tests plus documentation; CI runs them before the native compile.

^{Written for commit 79b7689. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 12 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 175a6ea1-72bb-42fb-ad4c-941661569327

📥 Commits

Reviewing files that changed from the base of the PR and between 0ec4791 and 79b7689.

📒 Files selected for processing (9)

• .github/workflows/ci-artifact-transport.yml
• docs/ci/app-host-layer-transport.md
• docs/ci/app-host-product-layers.md
• scripts/ci/app-host-products-archive.sh
• scripts/ci/app_host_layer_transport.py
• scripts/ci/app_host_layered_products.py
• tests/test_app_host_layer_transport.py
• tests/test_app_host_layered_products.py
• tests/test_app_host_products_archive.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}