ci(vm): cleanup vm build infra

[drew]

Summary

Publish openshell-driver-vm from the normal dev and tagged release workflows, while leaving VM runtime tarballs on the on-demand vm-runtime workflow/release. The legacy openshell-vm crate remains in the repository but is excluded from workspace builds and active CI paths.

Related Issue

None.

Changes

• Add reusable macOS VM driver build workflow and wire Linux/macOS driver artifacts into dev and tagged releases.
• Move runtime pins and kernel config under crates/openshell-driver-vm/runtime.
• Publish runtime tarballs from the on-demand VM runtime workflow to the rolling vm-runtime tag/release.
• Align VM Linux runtime and macOS driver host jobs with the shared CPU runner labels; keep the native macOS runtime job on macos-latest-xlarge.
• Add GitHub artifact attestations for VM runtime tarballs and VM driver release tarballs.
• Remove VM-specific checksum files from releases; keep the general openshell-checksums-sha256.txt used by install-dev.sh.
• Use gh release download instead of curl/API URL plumbing for VM runtime release assets consumed by driver workflows.
• Remove the old release-vm-dev.yml, standalone VM wrapper/tasks, and install-vm.sh.
• Remove the install-dev.sh Linux package snippet from generated dev/tag release notes.
• Make install-dev.sh install the selected Debian package via OPENSHELL_VERSION, including the gateway and VM driver.
• Update canary coverage, docs, and stale references for the new release shape.

Testing

• mise run pre-commit passes
• Shell syntax checks for changed VM scripts and installers
• Workflow YAML parse checks for changed release workflows
• cargo check -p openshell-driver-vm
• cargo metadata confirms openshell-vm is excluded from workspace members
• Reference checks for removed install-vm, release-vm-dev, and stale VM paths
• Manually triggered release-vm-kernel.yml on dn/consolidate-vm-ci: run 25421146257 passed, refreshed the vm-runtime prerelease without checksum assets, and generated GitHub artifact attestations before the final runner-label change
• gh attestation verify vm-runtime-linux-x86_64.tar.zst -R NVIDIA/OpenShell succeeds for the refreshed vm-runtime asset

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-1186.docs.buildwithfern.com/openshell

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.