feat(model-guard): protect presets and deploy SOURCE builds

[Fernandez81]

Summary

Add the public CosmoEdge side of Model Guard v2.3 and make source-modified
BM1688 builds directly deployable as SOURCE packages.

The runtime uses one device-bound certificate for all current and future preset
models. It does not use per-model licenses, model allowlists, dependency
snapshots, or SDK admission manifests. Signed production releases remain a
separate supported workflow.

Related issue

Closes #59
Closes #63

Root cause

Preset models previously had no uniform protected loading path, while modified
source builds could not be installed without going through production release
signing. Earlier iterations also accumulated admission metadata and deployment
state that were not needed to protect models.

Scope

In scope

• explicit BMRuntime ownership and lifecycle;
• CMG_2.0 loading for protected preset models;
• approved distributable Guard runtime library and public header;
• two protected BM1688 preset artifacts;
• signed production-release packaging and update transactions;
• deployable SOURCE package with install and status;
• removal of redundant file, ABI, and dependency admission gates;
• English and Chinese deployment/security documentation.

Out of scope

• Guard implementation sources or private trust inputs;
• device provisioning from a SOURCE package;
• hardware-backed non-exportable device keys;
• SOURCE backup, rollback, or restore commands;
• candidate-specific BM1688 deployment in this PR creation step.

Risk tags

• Runtime / lifecycle
• Thread / memory safety
• API / authentication / network
• Media / streaming
• Model / inference / flow
• Frontend console
• Build / package / deployment
• Compatibility / migration
• None of the above

Type of change

• Bug fix
• Feature
• Documentation
• Build / deployment
• Refactor
• Test

Area

• Backend service
• Frontend web console
• Pipeline / scenario configuration
• Model import / model runtime
• API / MQTT / WebSocket
• Media / streaming
• Build / deployment
• Documentation

Candidate identity

• Base commit: b3fcd6cdd565681d1db8b0fe23fc228bfbeffb72
• Candidate commit: 4e618bc9a865a4368effec66d7155b293986b67c
• Candidate tree: 2e19085f27d1d2576d1b059f96ef15f657854ecf
• Package SHA-256: 3bc92e25d0898b83e5afed92f7979c4ebe4be677a849157d2509cca09448ba00
• Test binary SHA-256: 03ed0d5d5c2076ec411690af25e9068d0d750d20e29c47021428d7cdaa3d583b

The branch was rebased onto the listed base before this evidence was collected.
It was not amended, rebased, or merged afterward.

Verification

Parent baseline

PASS: the protected runtime, installer, and bundled Guard SDK paths are absent
from origin/main; the feature is newly introduced rather than a regression
fix.

git ls-tree -r --name-only origin/main -- \
  prebuild/model-guard-v2 src/nn/guard install-device.sh

Candidate checks

git range-diff b0fc141d..7b0dc2da origin/main..HEAD
# PASS: all 11 patches equivalent after rebasing

git diff --check origin/main...HEAD
# PASS

docker-compose -f docker-compose.sophon.yml run --rm cosmo-sophon-package
# PASS: AArch64 application and cosmo-tests built
# PASS: resource-i18n 3587/3587 and frontend i18n 1748 keys
# PASS: package profile 12, SDK verifier 7, health check 3,
#       release updater 71
# PASS: AArch64 ELF and SOURCE package content audits

./.codex/validate_candidate.sh --issue '#59' --base origin/main \
  --package build/packages/cosmo-V1.0.0-SOURCE-4e618bc9a865a4368effec66d7155b293986b67c-c2ae041193615f0c5b8ba968fde71be74501c84c977daf03e850779aadb06d92-3bc92e25d0898b83e5afed92f7979c4ebe4be677a849157d2509cca09448ba00.tar.gz \
  --tests build/cosmo-tests
# PASS

Risk-based evidence

• API/network: upgrade upload rules and updater tests pass; no API contract was
  added.
• Media/streaming: no media transport behavior changed.
• Sophon/device: AArch64 build passed; device execution for this rebased
  candidate is not yet recorded.
• Frontend/UI: production Vite build and both locale checks pass.
• Package/deployment: SOURCE content audit and installer tests pass; prohibited
  provisioning, private trust, bootstrap, and obsolete SDK manifest entries are
  absent.

Documentation impact

• Documentation was updated.
• Documentation is not needed for this change.
• Documentation will be handled in a follow-up.

Compatibility and deployment impact

• This change is backward compatible.
• This change may affect public APIs, configuration files, pipelines,
  deployment scripts, or model artifacts.
• Not applicable.

The public Guard ABI remains CMG_2.0 with SONAME
libcosmo_model_guard.so.2. Protected preset loading requires a valid
device-bound certificate.

Third-party code and assets

• This PR does not add third-party code, models, datasets, media, or
  generated assets.
• This PR adds third-party materials, and their source and license are
  documented.
• This PR does not include GPL, AGPL, or other strong copyleft code.

The two added protected preset artifacts are first-party distributable
artifacts, not third-party or plaintext model weights.

Security and release checklist

• No secrets, tokens, private keys, or certificates are included.
• No real device SN values, customer names, or private IPs are included.
• No private model weights or proprietary download links are included.
• New dependencies have an acceptable license and are documented.
• Documentation was updated if behavior changed.
• My commits are signed off with Signed-off-by: according to the
  DCO-style requirement in CONTRIBUTING.md.
• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md.

Acceptance and cleanup

• Candidate-bound acceptance: pending BM1688 validation for this rebased
  candidate
• Device test filter: N/A in this PR creation step
• Device backup state: N/A
• Temporary-data cleanup: complete
• Final Git status: clean
• Evidence was collected from the candidate commit listed above.
• Any source change after validation invalidated and restarted the required
  checks.
• No temporary credentials, media, models, device exports, or generated
  packages are included.

Notes for reviewers

Suggested review order follows the 11 commits:

1. BMRuntime ownership
2. Guard runtime SDK admission
3. protected model loading
4. protected preset artifacts
5. signed release transactions
6. signed upgrade archives
7. Sophon packaging
8. SOURCE installation
9. security/release documentation
10. Chinese SOURCE documentation
11. redundant admission-gate removal

This is intentionally a draft until candidate-specific BM1688 evidence is
attached.