fix: download pinned laufey archives directly for CI prewarm

[Copilot]

The laufey prewarm step was invoking deno desktop with the freshly built PR binary, which forced desktop runtime resolution through libdenort and fell back to a canary download keyed by the PR merge SHA. On Linux, that path always 404s because PR SHAs do not have canary desktop artifacts.

• What changed

  • Reworked tools/download_laufey.ts to fetch the pinned laufey backend archive directly from the laufey GitHub release instead of compiling a dummy desktop app.
  • Kept the existing CLI contract:
    • deno run -A tools/download_laufey.ts [backend] [cache_dir]
    • default backend remains cef (webview on Windows)

• Version / target / artifact resolution

  • Reads the pinned laufey version from cli/laufey_sums.lock (# version: vX.Y.Z).
  • Derives the native target triple from Deno.build.
  • Resolves the upstream artifact name exactly as laufey publishes it, including the raw -> winit archive mapping and Windows .zip handling.

• Integrity and cache layout

  • Looks up the archive SHA-256 in cli/laufey_sums.lock and verifies the downloaded bytes before extraction.
  • Extracts into the same shared cache layout LaufeyBackendResolver already expects, including the .downloaded marker:

    <cache>/<version>/<backend>/<target>/
    

• Focused coverage

  • Added targeted tests for:
    • pinned version parsing
    • SHA lookup from cli/laufey_sums.lock
    • target triple derivation
    • archive name selection
    • cache path layout generation

• Example

  const version = parsePinnedVersion(lockContents);
  const target = laufeyTargetForBuild(Deno.build);
  const archive = laufeyArchiveName(backend, target);
  const url =
    `https://github.com/littledivy/laufey/releases/download/v${version}/${archive}`;