#12006 Fix nightly/release client bundling and VM CI regressions

Nightly and stable release builds can select a nonexistent cmux-tui artifact from a depth-1 checkout. This PR resolves the published client from real history and fixes the concrete CI regressions found while validating the release pipeline.

• Deepens shallow checkouts and excludes shallow boundary commits. Nightly permits up to five older published candidates with a warning; stable requires the newest candidate. Both keep the wireguard-hub capability check.
• Fixes the macOS Bash 3.2 installer crash when no capabilities are requested. An executable regression covers zero, one, multiple, and missing capabilities in Linux guards and macOS packaging. Executing the installed destination also verifies its permissions.
• Clears the Swift warning regressions, aligns the executable vm/cloud help expectations with the current command list, and makes scripted mobile response waiters complete with a test failure if the transport closes early.
• Preserves VmCreateInProgressError from concurrent Base resets so callers receive the existing retryable conflict instead of a database error.
• Carries the authenticated billing scope's machine allowance through paused-VM resume and recovery paths. A four-seat Team keeps its 200-machine allowance; explicit null stays unlimited; omitted values keep the existing plan default. Exec, resize, fork, port opening, and attachment/session paths share the same reservation logic. The allowance comes from resolved server-side entitlements, and the database continues to enforce counts before provider work.

Validation:

• Test-only commit 748c648aa5 reproduced 11 failing database cases in GitHub CI; the following fix passes all 21 cases locally. Coverage includes exec, resize, attachment, session, and cmux-remote access with explicit, unlimited, and omitted allowances.
• 74 route-auth tests, TypeScript, complexity, and targeted ESLint pass (one existing unused-variable warning).
• Installer regression reproduced the exact Bash 3.2 failure before the fix and passes afterward. Client resolver, nightly universal guards, test determinism, and test wiring pass.
• 18 of 19 complete database test files pass on local PostgreSQL 14. The remaining iroh tests use numeric-separator SQL syntax requiring PostgreSQL 16; GitHub CI uses PostgreSQL 16 and is running the complete suite on the updated HEAD.

Current main is merged, with no conflicts. Localization audit: internal executable help expectations and existing error routing only; no product strings or message catalogs changed. No release was published and no PR was merged.