fix: llama-server start breakage — version detection, flag-validation race, model dir resolution, user-bus pre-flight

User report after the llamacpp app install: 'installed llama.cpp unknown',
valid flags rejected (randomly per run), 'Model not found' for the HF
downloader's own layout, and a systemd user-bus failure over SSH. Detective
(real b10822 binary, FACT) found four independent causes:

- version: llama-server --version prints to STDERR; detect_llama_version's
  2>/dev/null swallowed it -> always 'unknown'. Now captures 2>&1 + accepts
  semver/build tokens (incl. build 1.2.3 edge)
- validation: printf|grep -q under pipefail -> SIGPIPE rc=141 race randomly
  rejected flags present in the 59 KB --help. Now pipe-less grep (no race);
  20x determinism regression test
- model resolution: resolve_model accepted files only, but the HF downloader
  creates <models>/<repo>/file.gguf dirs. Now expands a dir with exactly one
  *.gguf (never silently picks; multi-gguf lists + errs)
- port: llama.cpp default 8080 vs tool/adapter 8088; validation reliability
  means --port is now always pinned in the unit
- user bus: headless/SSH sessions lack XDG_RUNTIME_DIR -> ensure_user_bus in
  lib/common.sh pre-flights all three systemctl --user tools with remediation
  text; pos ai server --no-unit direct-run escape hatch (pidfile) for boxes
  with no bus
- find_llamacpp narrowed to llama-server/llama-server-cuda (bare 'server'
  fallback hazard); installer post-install sanity (version+help execute,
  symlink targets resolve)

Architect decisions DQ1-DQ6 recorded. Tester: 4 new regression files
(version-from-stderr, 25x flag-validation determinism, model dir expansion,
bus pre-flight + E2E) + 3 fixture updates; suite 16 files / 269 checks.

Verified: make gen idempotent; make check OK; make lint 0 FAIL, 0 WARN;
make test 269/269 (~49s); bash -n clean; git diff --check clean.

lib/common.sh

@@ -139,6 +139,20 @@ confirm() {
     esac
 }
 
+# ── User systemd bus pre-flight ────────────────────────────────
+# ensure_user_bus — verify the per-user systemd bus is reachable BEFORE a tool
+# writes a unit file or calls `systemctl --user`. SSH/headless shells often
+# have neither XDG_RUNTIME_DIR nor DBUS_SESSION_BUS_ADDRESS set; systemctl
+# then fails AFTER an orphaned unit was already written. On failure errs with
+# remediation and never returns, so callers abort before writing anything.
+ensure_user_bus() {
+    systemctl --user show-environment &>/dev/null && return 0
+    err "cannot reach the user systemd bus (common in SSH/headless sessions) — systemctl --user failed
+    fix: export XDG_RUNTIME_DIR=/run/user/$(id -u)     (if the directory exists)
+    fix: sudo loginctl enable-linger $(id -un)        (persist the user session so the bus survives logouts)
+    no unit was written — fix the bus and retry"
+}
+
 # ── system.env loader ──────────────────────────────────────────
 # Shared "system" tool config (~/.config/linux_post_install/system.env).
 # Fills only variables that are not already exported — an explicitly-set