Installer update: check every model the release calls before deploying - #319

Summary

coderhelm-selfhost update, run from someone's machine, now does the same model check as the updater before it applies a release. It reads the release's models.json only after the signed SHA256SUMS check from #310 passes. It then tests each model through the install's provider and stops with the same one-sentence fix and console link. --skip-model-check passes only a model the release doesn't call. Follow-up to #318.

Changes

• installer/lib/release.mjs: releaseModels() runs inside fetchRelease, after verifySignature.
  • It reads models.json only when the signed SHA256SUMS lists it, and only when the file matches its checksum.
  • When the release was verified with gh instead of cosign, models.json must also carry its own build attestation.
  • It refuses a list made for another release, and throws if it is called without a completed signature check.
  • A signed release that lists no models returns null. This also applies to cached releases, which are checked again.
• installer/lib/commands.mjs: update runs updateModelCheck after the release is fetched and verified, and before migration notes, the diff or deploy.
  • The install's <prefix>-worker gets a model_check direct invoke with the release's models plus the config's own, using the release's Bedrock ids per prefix. The probe team comes from the SYSTEM/MODELS record.
  • Each model prints PASS, FAIL or SKIP. A FAIL shows the fix and the console link.
  • A refused model the release calls (or the config names) stops the update, and --skip-model-check can't override it.
  • --skip-model-check passes only failures on models the release doesn't call, and records "model check skipped for …" in the result file.
  • A worker that doesn't answer also stops the update.
  • Rollback, --source checkouts and dry runs skip the check.
  • Nothing accepts terms or subscribes.
• installer/lib/cli.mjs: help for --skip-model-check.
• infra/lib/updates-stack.ts: the update build runs coderhelm-selfhost update, so its role may now invoke <prefix>-worker and read the settings table, limited to the SYSTEM partition by a LeadingKeys condition. The same check therefore runs inside the build too.
• Docs: updates.md and model-providers.md describe the CLI check and the skip rule.

Verification

• Installer npm test: 97 pass. The new tests cover:
  • models.json is fetched only after verify-blob passes, and never when the signature fails.
  • A file changed after signing is refused.
  • With gh, models.json needs its own attestation.
  • Nothing is read without a completed signature check, and another release's list is refused.
  • A refused model the release calls stops the update before deploy, with the fix and link, even with --skip-model-check.
  • A pass deploys.
  • Skip works only for a model the release doesn't call, and the result note records it.
  • A model the config names is required too.
  • A worker that doesn't answer stops the update.
  • The worker payload carries the release's Bedrock ids and the probe team.
  • No marketplace, agreement or use-case command ever runs.
  • A signed release without a model list, and a checkout, skip the check with no AWS calls.
• infra npm test: 64 pass, including the build role's new worker invoke and SYSTEM-only GetItem.
• python3 -m unittest discover -s lambda/tests and node --test selfhost/launch/*.test.mjs pass. No Rust changes.