Install from github.com and local disk when zpkg.net (registry + Cloudflare) is down #378

Requirement

zed-cli and zed tooling must be backed by github.com: zed install has to work when both the Cloudflare edge (cdn.zpkg.net) and our zpkg.net servers are down. It should go directly to github.com, and also check local disk for packages.

(Linear DEN ticket could not be created: the workspace is at its free issue limit. This issue is the tracker until that is resolved.)

Live reproduction (2026-09-12)

registry.zpkg.net returns 503 registry_origin_unavailable. zed-cli built from main @ a80dad7, run in a fresh clone of ores-wasm-loaders/owls-runtime.rs, which depends on ores-wasm-loaders/owls-interfaces = "=0.1.1":

• zed install --frozen: the GitHub fallback derives sha eeb8bb… from the v0.1.1 tag archive. The lock pins fea1f8…, so it fails with "registry artifact … changed; refusing".
• zed install: fails. Every R2, GitHub Release and GHCR (403) location is tried; the tag archive is never downloaded.

Findings

1. Bug A – GitHub tag-archive fallback defeats itself (src/source_fallback.rs). github_get_version → fill_digest downloads the tag archive (no sha yet) and records its sha256. download() → download_locators then sees a known sha and skips GithubArchive, so the only source that worked is excluded.
2. Bug B – doubled mirror URLs. github_get_version turns every locator into a mirror with MirrorDescriptorV1::from_locator. An ObjectStore mirror gets a full object URL as its base, and artifact_urls appends keys to it.
3. Packages aren't guaranteed to be on GitHub. owls-interfaces v0.1.1 had a tag but no zpkg-*.tar.gz Release asset.
4. Committed lockfiles leak machine-local sources. owls-runtime.rs/.zpkg.lock had source = "file:///tmp/ores-wasm-registry".
5. Local disk. Only the content-addressed store (by sha) was checked; checkout discovery is being salvaged separately.

Current status (2026-09-14)

• Fix Bug A and Bug B in zed-cli, with unit tests (fix(fallback): install from github.com tag archives when zpkg.net is down #379 merged).
• Frozen registry-down recovery from github.com with exact locked digest, including zed fetch --frozen.
• Backfill owls-interfaces v0.1.1 GitHub Release asset from immutable tag/commit with digest verification; post-upload frozen recovery passed.
• Independent exact-head outage E2E in zed-pkg-test for five ecosystems.
• Cross-platform clean-home outage certification on Ubuntu 24.04, macOS 14, and Windows 2022.
• Finish portable lock serialization: generated committed locks must never retain file://, loopback, or ephemeral mirror provenance.
• Regenerate owls-runtime.rs/.zpkg.lock from a clean public-source environment and certify empty-home frozen replay.
• Finish local-disk checkout resolution salvage (DEN-3488 race local checkouts with registry resolution for symlink installs #381) and merge only after exact-head product + independent E2E evidence.
• Make successful publish require/verify the GitHub recovery artifact, with an explicit safe backfill path rather than best-effort mirroring.
• Complete transport ownership migration (Architecture audit 2026-09-06: require zed-clients ownership of CLI transport #331): move GitHub/CDN/fallback HTTP behavior into typed zed-clients APIs.

Open policy: immutable digest/version/commit remain the security identity; source provenance is explanatory/recovery metadata and cannot authorize changed bytes.