fix: switch to official SmolVM retained forks

Merged
BN
2mo ago
+157-86

What & why

Protocol surface

  • I confirm this change touches the runner protocol interface: YES / NO

Required gates

  • just test-ci passes locally (fmt-check + clippy -D + full test suite + runner-watch conformance)
  • If protocol/wire shapes changed: the change is validated against the official runner (golden replay via runner-watch, or a live capture showing the official bytes), not only unit tests
  • If the touched subsystem has property tests (concurrency_properties, scheduling, matrix expansion, …): they are extended for the changed contract and pass (PROPTEST_CASES=256 cargo test -p preloop-runner-server)
  • New wire fields/events are additive and serde-defaulted where the official runner would not send them
  • No secrets, credentials, or internal/deployment-specific paths are introduced (captures with live tokens must be redacted or excluded)

Verification performed

Checklist

  • Tests added/updated for any new observable contract
  • Docs updated (docs/, CONTRIBUTING.md) where behavior changed
  • Changelog-worthy user-facing change described in the PR body

Summary by cubic

Switches to the official smol-machines/smolvm v1.7.7 and gates retained-fork behavior by the resolved smolvm binary’s version. Old behavior: an env flag enabled multiple live forks; new behavior: probe smolvm --version once per provider — <1.7.7 keeps the single-live-clone guard, ≥1.7.7 allows multiple live clones while still serializing forks per golden — preventing fork-base corruption on older or unprobeable installs.

  • Pins smol-machines/smolvm@v1.7.7; preloop update --ensure-runtime installs this exact version and verifies --mount-socket; removes PRELOOP_SMOLVM_RELEASE_REPOSITORY/PRELOOP_SMOLVM_RELEASE_VERSION.
  • Removes PRELOOP_SMOLVM_RETAINED_FORKS; provider caches a version probe (fail-closed) and rejects a second live fork only when retained checkpoints are absent.
  • Keeps the OCI fallback when a spent golden cannot be safely re-armed beside a live clone.
  • Stops advertising darwin-x86_64 in the install matrix; Intel macOS hosts won’t claim an installable runtime.
  • Deletes the temporary retained-fork runtime doc and updates CLI/self-hosting docs.