Resume native installer downloads

[SaladDay]

What

The native bootstrap (bootstrap.sh, bootstrap.ps1) now keeps and resumes the installer archive, detects stalls instead of capping the download at 20 minutes, and checks the grant and options before it downloads.

• Archive cache: <Runtime home>/native-download/<sha256>.tar.gz (verified) and .part (partial), outside the staging directory the bootstrap wipes. Core's checksum names the file, so another build never reuses it; other archives in the directory are pruned. A cached archive is verified on every run and deleted if it fails. The verified archive is kept after a failed install so a rerun needs no download, and removed when the installation completes.
• Resume and stall: curl --continue-at - (PowerShell: Range header, 206 appends, 200 restarts), --speed-limit 1024 --speed-time 60, no --max-time, five attempts like the Core launchers (Make the installer launchers robust #722). Retried curl codes: 6, 7, 16, 18, 28, 33 (server cannot resume: the part is deleted and the download restarts), 35, 52, 55, 56, 92 and HTTP 408/429/5xx. No --retry-all-errors. The final message names the network to Core and GitHub and HTTPS_PROXY.
• Early check, with no new Core route: the existing POST /api/v1/agent-daemon/installation (side-effect free, "does not claim or rotate credentials") answers a 401 for an expired or wrong grant. bootstrap.sh sends it as printf 'header = ...' | curl --config -, so the grant stays out of argv. Only a 401 stops the bootstrap; any other answer is left to the installer. The same response's harness is mapped (codex, claude_sdk, mcode to codex, claude, minimax) to check that --harness names known Harnesses and includes the Session Harness; --install-dir/--bundle-dir must be absolute. The installer stays authoritative (it still validates everything).
• Docs: disk requirement and the cache in self-hosted.md (EN + zh, source_hash refreshed). Measured on the v0.0.12-rc.1 linux-amd64 release archive: 316 MiB archive, 907 MiB unpacked (codex 320, claude 258, node 227, minimax 134 MiB), installed about 560 MiB for one Harness and about 940 MiB for all three. Peak about 2 GiB (one Harness) to 2.2 GiB (all three). macOS and Windows archives are 285 and 274 MiB.

Cache path for oac-daemon uninstall (G5): <Runtime home>/native-download (OAC_RUNTIME_HOME, default ~/.oac), holding download.lock and, after a failed install, <sha256>.tar.gz[.part].

Why

Audit F3 (no resume or reuse, 20-minute cap, mistakes found only after the download) and P2 F21 (disk requirement).

Verification

• go test for services/core/internal/nativeinstaller (Bootstrap tests, 3 runs): pass. New tests: resume after a stall (the stall window is shortened through a curl wrapper), archive kept after a failed install and removed after success, corrupt cached archive discarded, expired grant/wrong or unknown Harness/relative directory stop before any archive request. Existing fixtures now honour Range.
• go vet ./..., python3 scripts/check-names.py, node --test website/tests/translations.test.mjs tests 1-2 pass.
• Real 316 MiB release archive downloaded through the curl flags to measure sizes.

Skipped

• Translation test 3 (needs vitepress).
• scripts/native-onboarding-smoke.mjs locally (needs a built native bundle); CI native jobs on macOS and Windows run it. PowerShell changes cannot run on this host; the Windows job covers them.

Note

A grant lasts 30 minutes. A download slower than that now finishes, the installer's own grant call then answers "expired", and a fresh command reuses the cached archive without downloading again.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}