Decouple Desktop and managed runtime releases with a signed compatibility manifest

[tulayha]

Problem

VidXP Desktop currently installs one exact managed-runtime package version with embedded constraints. Embedding the exact validated wheel in the native installer makes fresh beta candidates testable before that package is published, but compatible Python-only runtime updates still require a new native Desktop build.

Resolving an unpinned or unsigned "latest" package from PyPI would weaken reproducibility, rollback, and compatibility guarantees.

Desired outcome

Allow a supported Desktop build to discover, validate, install, and roll back compatible managed-runtime releases independently of native Desktop releases.

Proposed contract

• Publish signed, immutable runtime channel metadata for beta and stable.
• Pin the package artifact URL, SHA-256, constraints artifact and digest, Python version, capability-manifest digest, and runtime release identity.
• Declare the supported Desktop probe/launch protocol range or equivalent compatibility bounds.
• Verify signatures and hashes before installation; reject incompatible or downgraded metadata.
• Preserve the existing staged install, dependency/model validation, atomic activation, and previous-runtime rollback behavior.
• Retain the wheel embedded in Desktop as an offline/bootstrap fallback.
• Keep user-owned external installations explicitly owner-managed.

Acceptance criteria

• A compatible Python-only runtime release can be validated and published without rebuilding Desktop.
• Desktop rejects unsigned, tampered, incompatible, or stale runtime metadata.
• Beta candidates can be installed from an immutable prepublication artifact source.
• Failed updates leave the active runtime unchanged and retain a usable rollback target.
• Release/version documentation and workflows describe the independently versioned artifacts and compatibility policy.
• Automated coverage exercises update, rejection, failure, and rollback paths on macOS, Windows, and Linux.