feat(installer): Lemonade system prerequisites + FLM .deb (PR-4)

[thinmintdev]

Summary

PR-4 of the Lemonade migration (docs/internal/lemonade-adoption-plan-2026-05-22.md §11). Adds a new install.sh step that lands Lemonade's system-level prerequisites BEFORE PR-5 drops the lemond binary, config.json, and systemd unit.

Three pieces, in order:

1. ppa:lemonade-team/stable — provides libxrt-npu2, the AMDXDNA NPU runtime FLM dlopen()s at start. Without it flm serve fails with cannot open shared object libxrt_coreutil.so.2.
2. FLM transitive runtime libs (apt) — libxrt-npu2 + ffmpeg6 (libavformat60/libavcodec60/libavutil58/libswscale7/libswresample4) + libboost-program-options1.83.0 + libfftw3-single3. Listed explicitly so a future ABI bump is a visible single-line edit, not silent metapackage drift.
3. FastFlowLM .deb v0.9.42 — pinned URL + SHA-256, fetched from upstream releases. Verified BEFORE dpkg installs; fail-soft if unreachable or checksum mismatches; smoke-tested with flm validate post-install (soft on failure — NPU-absent hosts stay viable for GPU-only hal0).

Constraints honoured

• Idempotent. add-apt-repository -y dedups, apt no-ops on installed packages, dpkg-query short-circuits the .deb fetch when v0.9.42 is already installed.
• Dev mode skip. --dev logs what would have happened, never touches the host's apt or third-party sources.
• Non-apt hosts (CachyOS, Fedora, etc.) warn + continue — FLM upstream only ships .deb + Windows .msi.
• FLM is optional. Download failure / SHA mismatch / flm validate failure all warn + continue. NPU paths gate on flm validate succeeding later; GPU-only hal0 still ships.
• Bumped UI_STEP_TOTAL from 8 → 9 (base) for the new step.

Open follow-ups

• FLM_DEB_SHA256 ships as the all-zeroes placeholder. HAL0_SKIP_FLM_SHA=1 unblocks the install path; the real checksum needs to be pinned in lockstep with the v0.2 ship cut (tracked in the v0.2 release checklist).
• PR-5 (next) consumes this section's output — depends on libxrt-npu2 + flm being on PATH before it writes flm.args = "--asr 1 --embed 1" into config.json.

Anti-scope (deferred to PR-5 / PR-6)

• No lemond binary download.
• No config.json writer.
• No hal0-lemonade.service systemd unit.
• No touching the server_models.json block (PR feat(lemonade): server_models.json generator from registry.toml (#141) #151 already in main).

Refs

• Plan: docs/internal/lemonade-adoption-plan-2026-05-22.md §11 PR-4 + §3 (service topology) + §5 (NPU + FLM trio)
• ADR-0008 (Lemonade adoption)
• ADR-0009 (FLM trio NPU packing)
• Memory hal0_lemonade_flm_npu_install — the manual install recipe this section automates

Test plan

• bash -n installer/install.sh — syntax OK
• shellcheck installer/install.sh — no new warnings on the added section
• pytest tests/ -q — 1443 passed, no regressions
• ruff check src tests — clean
• ruff format --check src tests — clean
• On hal0 LXC: run sudo bash installer/install.sh on a fresh container; assert PPA added, libs installed, flm validate succeeds (deferred until PR-5 lands lemond — until then verify the step runs cleanly + is idempotent on re-run)

🤖 Generated with Claude Code