build(sdk): prepare verified runtime artifact pin updates

[cm2435-hcomp]

What

Prepare the SDK-owned runtime artifact pin updater. Validate the manifest and hashes before changing the version; retain the legacy CLI publication target until its migration ships. No candidate hashes become public defaults in this change.

Why

Artifact versions and checksums should have one validated handoff into the SDK; partial updates or premature removal of CLI ownership can break consumers.

How

Validate artifact metadata and hashes before rewriting the runtime manifest; keep the existing CLI release target until its migration ships.

Validation and dependencies

P5c, based on #222. After P5a produces a reviewed immutable release, use this helper to update the actual SDK pin; SDK/CLI publication remains gated on compatible released dependencies.

Validation: both updater regression tests pass (valid updates and rejection without partial writes). No runtime publication is performed.

Stack navigation: P1 contract → P2 runtime; P3 generation + P4 SDK; P5 checks: runtime, generation, SDK pins; P6 CLI. P7 duplicate pin cleanup follows only after P6 ships. HoloWork integration is subsequent work.

Review guide: intent, architecture, service tradeoffs and merge order.

---

Note

Low Risk
Release-time maintenance tooling and docs only; pinned version and digests in the manifest are unchanged until someone runs the script.

Overview
Adds scripts/bump_runtime.py, a stdlib-only maintainer tool that rewrites PINNED_RUNTIME_VERSION and every published platform’s sha256 in manifest.py in one atomic edit. It rejects partial bumps (unknown platforms, missing shas, or ambiguous literals) so a version bump cannot leave stale digests on new CDN URLs.

Documents the workflow in README (“Runtime release maintenance”): run after a verified release with --version and --sha PLATFORM=SHA256 for each platform in the manifest; schema generation does not touch the pin; legacy CLI pin PRs stay until SDK/CLI migration ships.

manifest.py only updates its module docstring to point at the script. tests/test_bump_runtime.py covers successful full updates and failure with no file write when shas are incomplete.

^{Reviewed by Cursor Bugbot for commit ee14299. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cm2435-hcomp]

bugbot run

[cm2435-hcomp]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit cb86d87. Configure here.}

[abonneth]

Pushed directly (as agreed):

• Merged the updated feat(sdk): compose local agents with Desktop and Workstation #222.
• bump_runtime.py and its test now target src/hai_agents_local/runtime/manifest.py.
• README: the manifest lives outside the generated package, so the generator no longer needs to preserve it.

Tests: 230 passed, 12 skipped.

[abonneth]

Folded into #222 (fast-forward, same commits) to simplify the stack.