fix(agent): one engine-presence rule, and complete the engine step when the engine is installed

[gen16k]

The engine-detect session of waired-ai/waired#932's Wave 1 — the
highest fan-out blocker in that plan. Both issues land in
cmd/waired-agent/setup_desired.go and #187 depends on #179, so they
ship as one branch, one commit each.

Fixes #179
Fixes #187

Why

#179. The wizard's engine_installed came from the hardware
profiler's exec.LookPath probe; the daemon resolves its engine binary
by stat under the state dir. That is where waired's own install lands —
the normal case, and the only one on Linux — so /setup/state and
/inference/status contradicted each other on the same host at the same
instant. Everything downstream follows: the model pull is never
admitted, so the step contents never change, so the setup-progress dedup
suppresses every push, so last_check freezes, so the wizard renders
"no updates from this device", so the executor lease expires and the run
ends as executor_gone. A browser-driven setup showed no progress while
the terminal was visibly downloading. Third instance of this bug class
in this repo.

#187. The "Install the AI software" row stayed at "working on it"
for the whole model download: the engine step only reached done in the
ready case, and readiness there means the active model is ready. The
executor's own Done phase had no arm at all, and installed shadowed
the failed-phase arm, so a genuinely failed install on a
half-configured engine spun forever.

What changed

cmd/waired-agent/engine_resolve.go (new)

The rule now exists once, in a file named after it:

• resolveOllamaBinary(goos, stateDir, borrowed) — extracted verbatim
  from the bootstrap's ollamaResolver closure, which now calls it.
  Takes goos rather than reading runtime.GOOS so the Linux-strict
  branch is table-testable from any runner (CLAUDE.md §Cross-OS parity).
• vllmVenvActive(stateDir) — the <state-dir>/runtimes/vllm venv
  check, previously open-coded in two places.
• engineInstalledOnHost(goos, stateDir, cfg, engine) — the single
  predicate, with the three-strikes history recorded at the top of the
  file so the next person reaching for exec.LookPath reads why not.

Call sites

• setupEngineState — the wizard's answer. Also drops the profiler's
  30 s cache from this path, so an engine the executor just installed is
  visible on the next frame instead of up to half a minute later.
• engineViable — the boot engine decision, which read the same PATH
  probe and so chose no-engine on a host whose engine waired had
  installed itself, then resolved a binary anyway. Included on the
  user's call: fixing only the wizard would have left the class alive in
  the function right below it.

snapshot's engine arm

Reordered strongest-evidence-first, and documented as the contract it
is:

ready -> phase==failed -> installed -> phase==done
      -> leaseLive && !elevated -> leaseLive -> everSeen -> default

The completion arm moves from case ready: to case installed:, and
phase == done gets the arm it never had. An engine that is serving
beats a stale failed phase from an earlier attempt; a failure the
executor reported beats mere on-disk presence, because a half-configured
install leaves a binary behind and still failed.

No new step ids — that set is a spec-level decision tracked separately
(waired-ai/waired#934).

Behaviour change worth naming

In bundled mode on Linux, a system ollama on $PATH no longer makes
the host viable at boot. It never actually was: the bootstrap refuses to
spawn it by design, because it is not the pinned engine. This only makes
the boot decision agree with what follows it — hasUsableEngine already
answered via the resolver, so subsystem_state was already correct.
reuse mode is the supported way to borrow a user's engine and is
unaffected; TestChooseEngine_BundledLinuxIgnoresSystemOllamaOnPATH
pins both directions.

Decision: pull admission stays gated on engine presence

#179's proposal item 4 asks to remove that gate. It was written against
the broken probe. The gate is the waired-ai/waired#904 guarantee that
lets the wizard write engine and model in one gesture — firing
PullModel at a host with no engine can only fail, and the operator
would watch a red "Download the AI model" for the whole install that
later turns green on its own. TestSetupPullWaitsForEngineInstall locks
it. With a correct probe plus the existing false->true re-admission
hook, item 4's intent is met without removing the belt.

Tests

Test-after rather than test-first for the extraction itself (it is a
verbatim move with the existing suite as its bar); the two regression
bars below were written against the failing behaviour.

• engine_resolve_test.go (new, untagged so it runs on all three OSes)
  • TestEngineInstalledOnHost_StateDirEngineWithEmptyPATH — the fix(agent): setup state derives engine_installed from a PATH-only probe that cannot see the bundled engine #179
    bar: empty PATH, engine under the state dir, across all three
    goos values and all three ollama_source settings.
  • TestSetupEngineState_SeesStateDirEngineImmediately — the same bar
    at the wizard's own endpoint, and it pins the freshness half: the
    two calls straddle the install microseconds apart, which the old
    30 s-cached implementation could not have answered. Built with a
    nil profiler on purpose — this path must not touch it.
  • TestResolveOllamaBinary_LinuxBundledIsStrict /
    _NonLinuxKeepsFallback — the GOOS table. The non-Linux case
    asserts on error identity (download.ErrNotInstalled) rather than
    on finding a stub, because ResolveBinary's binary name is fixed by
    the running OS's build tag, not by the goos argument.
• inference_choose_engine_test.go — chooseEngineProfiler's
  ollamaInstalled bool is gone (it no longer decides ollama viability;
  keeping it would have been a trap). Tests express "ollama is
  installed" on disk via fakeBundledOllama, mirroring the existing
  fakeVLLMVenv. Two new tests cover the state-dir-with-empty-PATH host
  and the bundled-vs-reuse PATH contrast.
• setup_desired_test.go — TestSetupEngineStepMatrix walks the whole
  (installed, ready, phase) space. Every row holds a live elevated
  lease, so each arm has to beat the running fallback the bug landed
  on. Includes (true, false, failed) -> Failed, the case fix(agent): engine_install is gated on model readiness and ignores the executor's own done phase #187 names.
  TestSetupEngineStepDoneDoesNotOutrunTheModelStep pins that
  completing the engine row does not make the model row look complete.
  TestSetupSnapshotStatuses's installed -> running expectation
  updated to done — that assertion was the bug.

Verification

All of CONTRIBUTING.md §"Building and testing", green:

gofmt -l .                                  # clean
go vet ./... && (cd proto && go vet ./...)
golangci-lint run                           # 0 issues
go test ./... -timeout 10m
(cd proto && go test ./...)
go build -tags prod ./... && go vet -tags prod ./...
go test -tags prod ./internal/buildflag/...
make verify-cross                           # linux/windows/darwin amd64+arm64

Scope left out

• The installtest assertion on engine_installed: true in the
  daemon-engine leg — test(installtest): macOS teardown poisons the host and never reinstalls, Windows never crosses UAC, and no leg asserts engine_installed #195 owns the installtest gaps and Wave 2 has it
  waiting on this PR.
• Splitting the engine step into download/install rows — needs the §7
  revision in waired-ai/waired#934.
• Progress streaming (feat(agent): stream engine download/install progress (bytes and rate) to the setup wizard #197), which was waiting on this file.
• internal/hardware/profiler.go is untouched. Its Engines map is
  still the right source for an engine's version (which needs the
  binary executed either way); it is only wrong as a presence probe,
  and engineInstalledOnHost documents that split.

---

Note on a CI failure seen before the rebase

The first run (and its rerun, which re-materialises the same merge
commit) failed TestGrantRoleGate_NoOwnerLatchFromForeignPeer in
internal/inference at waitForInFlight — a 2 s wait on goroutine
scheduling. It is not reachable from this diff: dependencies flow
cmd → internal, so internal/inference's test binary cannot compile
anything changed here, and every file in this PR is under
cmd/waired-agent/. It passes 300× locally on 4 pinned CPUs, and the
full go test ./... passes repeatedly under the same constraint;
main and the three sibling PRs open at the time were green on it.
The branch has since been rebased onto current main, which produced a
fresh run.