fix(direct): load current GenVM runner bundles

[MuncleUscles]

Problem and outcome

The direct runner could select cached GenVM v0.6.0-rc0 before the current manager release, so contracts pinned to Studio RC5 / GenVM v0.6.0-rc3 failed before execution. It also preferred the 11 MB platform manager archive, which contains executors but not the runner archives direct mode needs.

This makes direct mode resolve the current asset-bearing manager release (including an RC when no stable runner release exists), download only runner-bearing bundles, and keep explicit pins plus an offline cache fallback.

Implementation and validation

• resolve explicit GENVM_VERSION first, then the current live release, then the newest v2 cache, then the RC3 fallback
• prefer stable runner releases; use the newest RC only when no stable runner-bearing release exists
• remove host manager archives from runner bundle candidates
• move bundles and extracted trees to v2 cache namespaces so invalid legacy RC3 caches are ignored
• validate ZIP member paths and discard partial extractions to prevent traversal or poisoned caches
• add regression coverage for live-vs-cache precedence, prerelease selection, drafts/assetless releases, offline fallback, bundle selection, legacy cache isolation, and safe ZIP extraction

Validation:

• native-equivalent suites: 73 CLI + 41 gltest + 72 glsim + 18 loader + 14 release-policy tests passed
• full direct suite: 52 passed
• GenLayer Boilerplate direct suite with RC3-pinned contracts: 45 passed
• Black and diff checks passed

No full cross-repository E2E is requested for this dependency-free integration-branch fix; the release promotion gate remains the cross-repository boundary.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: dfe5e703-9632-421e-8c85-16e6d3c118ff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}