feat: ship single-file run distribution and list key reset

Compile-time run auth replaces zip sidecars, lengthens run keys, revokes
active sessions on reset, and exposes run-key reset in the server list.

platform/service/artifact_download.go

@@ -250,6 +250,12 @@ func distributionPackageFilename(base string, targetOS string, targetArch string
 	if arch != "" {
 		name += "-" + arch
 	}
+	if format == "raw-executable" {
+		if os == "windows" {
+			return name + ".exe"
+		}
+		return name
+	}
 	if format == "" {
 		format = "bin"
 	}
@@ -262,6 +268,8 @@ func packageContentType(packageFormat string) string {
 		return "application/zip"
 	case "tar.gz", "tgz":
 		return "application/gzip"
+	case "raw-executable":
+		return "application/octet-stream"
 	default:
 		return "application/octet-stream"
 	}