fix(desktop): use a managed headless Ollama runtime

[tulayha]

Related issue

No linked issue.

Summary

• reuse a healthy external Ollama service or an existing Ollama executable without taking ownership
• otherwise ask before downloading the official Ollama 0.32.5 headless archive into VidXP private application data on Windows x86-64 and macOS Apple Silicon
• pin each managed artifact by URL, byte count, and SHA-256; reject unsafe archive entries and activate only a completely extracted runtime
• keep runtime download, extraction, service startup, and model pull inside the central cancellable setup flow with visible progress and partial-file cleanup
• include the possible headless-runtime download in the setup storage estimate and document the external-install requirement on Linux
• never invoke WinGet, Homebrew, or an Ollama desktop-app installer for local grounded answers
• accept CDLA-Permissive-2.0 in the locked Rust license policy and regenerate the complete Desktop third-party notice inventory
• omit Promptfoo's unrelated optional provider packages from Codex benchmark installs while retaining the directly pinned Codex SDK
• enforce that the bundled Chroma service cannot publish a host port or use host networking

The managed Ollama behavior is a user-visible Desktop fix. The dependency and deployment safeguards are internal-only. This does not change stored repository/index formats and does not require a model or repository rebuild.

Validation

• $env:TAURI_CONFIG = '{"bundle":{"resources":[]}}'; cargo test --release --locked --manifest-path desktop/src-tauri/Cargo.toml — 91 native Desktop tests passed, including Windows ZIP and macOS tar.gz extraction coverage
• cargo test --locked --manifest-path desktop/src-tauri/Cargo.toml query_setup::tests -- --nocapture — 5 focused managed-runtime tests passed
• npm --prefix desktop run check — TypeScript typecheck, ESLint, 47 Vitest tests, and the production Vite build passed
• cargo about --version — confirmed the CI-pinned cargo-about 0.9.1 locally
• npm --prefix desktop run notices:check — the regenerated locked Rust and frontend notice inventory passed
• uv run --no-sync pytest -q tests/test_packaging.py -k "bundled_chroma_service_is_not_published or codex_benchmark_omits_unused_optional_providers or optional_ollama_profile_never_pulls_a_model_implicitly" — 3 targeted packaging tests passed; pytest also reported its existing local cache-path warning
• uv run --no-sync ruff check tests/test_packaging.py — passed
• npm ci --ignore-scripts --force in benchmarks/codex-mcp — test-only engine override installed 374 packages, omitted the unrelated optional provider tree, and audited 0 installed vulnerabilities; the normal install correctly rejected local Node 22.19 because the benchmark requires Node 22.22+
• npm ls @openai/codex-sdk --depth=0 — confirmed the direct Codex SDK remains installed
• npm ls @openai/codex-security @huggingface/transformers onnxruntime-node sharp adm-zip extract-zip --all — confirmed the unused optional packages are absent
• compared the embedded Ollama 0.32.5 artifact names, byte counts, and SHA-256 digests with GitHub release metadata — Windows x86-64 and macOS Apple Silicon matched
• npx --yes markdownlint-cli2@0.23.2 — passed
• cargo fmt --manifest-path desktop/src-tauri/Cargo.toml -- --check — passed
• git diff --check — passed

The real 1.36 GiB Windows runtime download and a real macOS runtime launch were not exercised locally. The archive paths were covered with synthetic ZIP and tar.gz fixtures, and the published asset metadata was verified. Promptfoo validation was not run because the local Node 22.19 runtime is below its enforced Node 22.22 minimum. Lychee was unavailable locally and Docker Desktop was not running, so the link and Compose configuration checks were not run; no external links were added and the Chroma invariant has direct regression coverage.