fix: llama-server start breakage — version detection, flag-validation race, model dir resolution, user-bus pre-flight

User report after the llamacpp app install: 'installed llama.cpp unknown',
valid flags rejected (randomly per run), 'Model not found' for the HF
downloader's own layout, and a systemd user-bus failure over SSH. Detective
(real b10822 binary, FACT) found four independent causes:

- version: llama-server --version prints to STDERR; detect_llama_version's
  2>/dev/null swallowed it -> always 'unknown'. Now captures 2>&1 + accepts
  semver/build tokens (incl. build 1.2.3 edge)
- validation: printf|grep -q under pipefail -> SIGPIPE rc=141 race randomly
  rejected flags present in the 59 KB --help. Now pipe-less grep (no race);
  20x determinism regression test
- model resolution: resolve_model accepted files only, but the HF downloader
  creates <models>/<repo>/file.gguf dirs. Now expands a dir with exactly one
  *.gguf (never silently picks; multi-gguf lists + errs)
- port: llama.cpp default 8080 vs tool/adapter 8088; validation reliability
  means --port is now always pinned in the unit
- user bus: headless/SSH sessions lack XDG_RUNTIME_DIR -> ensure_user_bus in
  lib/common.sh pre-flights all three systemctl --user tools with remediation
  text; pos ai server --no-unit direct-run escape hatch (pidfile) for boxes
  with no bus
- find_llamacpp narrowed to llama-server/llama-server-cuda (bare 'server'
  fallback hazard); installer post-install sanity (version+help execute,
  symlink targets resolve)

Architect decisions DQ1-DQ6 recorded. Tester: 4 new regression files
(version-from-stderr, 25x flag-validation determinism, model dir expansion,
bus pre-flight + E2E) + 3 fixture updates; suite 16 files / 269 checks.

Verified: make gen idempotent; make check OK; make lint 0 FAIL, 0 WARN;
make test 269/269 (~49s); bash -n clean; git diff --check clean.

apps/ai/llamacpp.sh

@@ -12,6 +12,29 @@ source "$(dirname "$0")/../../lib/common.sh"
 # instead of hitting /releases/latest.
 RELEASES_URL="https://api.github.com/repos/ggml-org/llama.cpp/releases?per_page=10"
 
+# Test seam for the post-install sanity (defaults to the real install target);
+# PATH must still contain the dir for the `command -v` check.
+LLAMACPP_BIN_DIR="${LLAMACPP_BIN_DIR:-/usr/local/bin}"
+
+# Post-install sanity (F7): fail fast on a genuinely broken install — missing
+# shared lib (binary won't execute) or a truncated archive (dangling symlink) —
+# with one clear err, instead of "version unknown / flags rejected" on the
+# first `pos ai server start`.
+llamacpp_sanity() {
+    local bin="$LLAMACPP_BIN_DIR/llama-server"
+    [ -e "$bin" ] \
+        || err "llama.cpp install sanity failed: $bin is missing or a dangling symlink (truncated archive?)"
+    command -v llama-server >/dev/null 2>&1 \
+        || err "llama.cpp install sanity failed: llama-server not on PATH — check that $LLAMACPP_BIN_DIR is in PATH"
+    # llama.cpp prints --version to STDERR (common/build-info.h), so 2>&1 is
+    # required to actually exercise the stream the tool chain reads.
+    llama-server --version >/dev/null 2>&1 \
+        || err "llama.cpp install sanity failed: 'llama-server --version' did not run — missing shared library or truncated archive"
+    llama-server --help >/dev/null 2>&1 \
+        || err "llama.cpp install sanity failed: 'llama-server --help' did not run — missing shared library or truncated archive"
+    log "llama.cpp sanity OK — llama-server runs (version/help readable, symlink target present)"
+}
+
 install_llamacpp() {
     command -v llama-server &>/dev/null && { log "llama.cpp already installed"; return 0; }
 
@@ -56,6 +79,8 @@ sys.exit(1)
         rm -f /tmp/llamacpp.tar.gz /tmp/llamacpp-releases.json
     "
 
+    llamacpp_sanity
+
     log "llama.cpp $tag installed — run the server with 'pos ai server start <model.gguf>'"
 }