Refactor LLM runtime handling and enhance CLI documentation

- Updated `resolve_llm_runtime` to prioritize live configuration over legacy notes, ensuring accurate runtime resolution.
- Enhanced `tunnel_forwards` to prefer current configuration for LLM runtime, improving tunnel setup logic.
- Improved idle-killer logic to handle stale markers and provide clearer warnings in the status output.
- Updated CLI documentation in `cli.md` to reflect changes in command behavior and runtime handling.
- Enhanced tests to validate new runtime resolution logic and ensure proper handling of configuration states.

src/gpu_rent/remote/install_llamacpp.sh

@@ -22,19 +22,26 @@ chown -R "${SWARM_USER}:${SWARM_USER}" "$LLAMA_ROOT"
 SERVER_BIN="${BIN_DIR}/llama-server"
 if [[ ! -x "$SERVER_BIN" ]]; then
   log "скачиваю llama-server (cuda) release…"
-  # Pin a known-good release asset pattern; fallback to CPU if CUDA asset missing.
+  # Pin: LLAMACPP_TAG=b4690  LLAMACPP_ASSET_URL=...  LLAMACPP_SHA256=...
+  # Без pin — latest release (supply-chain risk; docs/llm.md).
   TMP="$(mktemp -d)"
   cd "$TMP"
-  API="https://api.github.com/repos/ggerganov/llama.cpp/releases/latest"
-  URL="$(curl -fsSL "$API" | python3 -c '
-import json,sys,re
+  LLAMACPP_TAG="${LLAMACPP_TAG:-}"
+  LLAMACPP_ASSET_URL="${LLAMACPP_ASSET_URL:-}"
+  LLAMACPP_SHA256="${LLAMACPP_SHA256:-}"
+  if [[ -n "$LLAMACPP_ASSET_URL" ]]; then
+    URL="$LLAMACPP_ASSET_URL"
+  elif [[ -n "$LLAMACPP_TAG" ]]; then
+    API="https://api.github.com/repos/ggerganov/llama.cpp/releases/tags/${LLAMACPP_TAG}"
+    URL="$(curl -fsSL "$API" | python3 -c '
+import json,sys
 data=json.load(sys.stdin)
 assets=data.get("assets") or []
 prefer=[]
 for a in assets:
     n=(a.get("name") or "").lower()
     u=a.get("browser_download_url") or ""
-    if not u.endswith(".zip") and not u.endswith(".tar.gz"):
+    if not (u.endswith(".zip") or u.endswith(".tar.gz")):
         continue
     if "cuda" in n or "cu12" in n or "cu11" in n:
         prefer.append(u)
@@ -42,12 +49,37 @@ for a in assets:
         prefer.append(u)
 print(prefer[0] if prefer else "")
 ')"
+  else
+    log "WARN: LLAMACPP_TAG/ASSET_URL не заданы — берём latest (нет pin). См. docs/llm.md"
+    API="https://api.github.com/repos/ggerganov/llama.cpp/releases/latest"
+    URL="$(curl -fsSL "$API" | python3 -c '
+import json,sys
+data=json.load(sys.stdin)
+assets=data.get("assets") or []
+prefer=[]
+for a in assets:
+    n=(a.get("name") or "").lower()
+    u=a.get("browser_download_url") or ""
+    if not (u.endswith(".zip") or u.endswith(".tar.gz")):
+        continue
+    if "cuda" in n or "cu12" in n or "cu11" in n:
+        prefer.append(u)
+    elif "ubuntu" in n or "linux" in n:
+        prefer.append(u)
+print(prefer[0] if prefer else "")
+')"
+  fi
   if [[ -z "$URL" ]]; then
-    log "не нашёл бинарь в latest release — поставь llama-server вручную в ${SERVER_BIN}"
+    log "не нашёл бинарь в release — поставь llama-server вручную в ${SERVER_BIN}"
     exit 1
   fi
   log "asset $URL"
   curl -fL "$URL" -o pkg.bin
+  if [[ -n "$LLAMACPP_SHA256" ]]; then
+    echo "${LLAMACPP_SHA256}  pkg.bin" | sha256sum -c -
+  else
+    log "WARN: LLAMACPP_SHA256 не задан — checksum skip"
+  fi
   if file pkg.bin | grep -qi zip; then
     apt-get install -y -qq unzip >/dev/null 2>&1 || true
     unzip -qo pkg.bin -d out