cloud(runner): embed the arc JIT runner as hanzo runner
Migrate arc-runner/arc (arc-archive) cmd/arcd host-role JIT GitHub-Actions
runner into hanzoai/cloud as package runner/, exposed as `hanzo runner` —
third verb of the one-binary trifecta: engine serves models, gpu connect shares
compute, runner claims CI. One org login, outbound-only, GPU/vulkan-aware.
- runner/: host-role JIT daemon (config, GitHub App auth, poll, JIT launcher,
/v1 control surface, WSL labels). In-cluster controller role deferred.
- cli: wire `hanzo runner`; also register `engine` in controlCommands (was
constructed but missing from the router — silently undispatchable).
- Security (red+cto reviewed): /v1 defaults 127.0.0.1 + localGuard (Host
allowlist vs DNS-rebind, Origin vs CSRF); child env stripped of secrets;
fork repos skipped by default (private/internal-org scoping is the real
containment; documented honestly).
- deps: +go-github/v52, +ghinstallation/v2; luxfi/keys v1.2.0->v1.2.2 (v1.2.0
tag mutated at origin — bump past it, verified under -mod=readonly, no bypass).
hanzo-dev
cbcc97117b