feat(runner): deliver native Kimi Code (#18391)

Deliver native Kimi Code setup, exact models, scoped credentials, verified packages and runtime packs. Preserve current upstream release attestations and restore verified same-run remote retry dispatch without weakening process ownership.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/docker-context-checks.Dockerfile

@@ -24,6 +24,8 @@ WORKDIR /context
 COPY . .
 # Verify ACPX release declarations against the exact Docker context.
 RUN node packages/paperclip-runner/scripts/generate-acpx-profiles.mjs --check
+# The provider-pack builder imports this offline smoke helper during image builds.
+RUN node -e 'import("./packages/paperclip-runner/scripts/kimi-provider-pack-smoke.mjs")'
 # Committed artifacts the image build reads whose drift checks cannot run
 # here (they need the locked dependency tree or compiled dist/). Existence
 # in the context is the property this probe guards; content correctness is

.github/workflows/docker-runner-check.yml

@@ -193,7 +193,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Prepare hosted image build capacity
-        if: (inputs.build_eval_image || inputs.publish_eval_image) && inputs.release_run_id == ''
+        if: inputs.build_eval_image || inputs.publish_eval_image
         run: |
           # These preinstalled SDKs are absent from the image build context.
           sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc