feat: ship single-file run distribution and list key reset

Compile-time run auth replaces zip sidecars, lengthens run keys, revokes
active sessions on reset, and exposes run-key reset in the server list.

platform/service/distributions.go

@@ -6,6 +6,7 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"os"
 	"strings"
 
 	"browser.local/platform/domain"
@@ -73,7 +74,7 @@ func (svc *CoreService) GenerateRunDistributionForSession(sessionID string, requ
 		RunEndpointID:    instance.RunEndpointID,
 		TargetOS:         request.TargetOS,
 		TargetArch:       request.TargetArch,
-		PackageFormat:    packageFormatForTarget(request.TargetOS),
+		PackageFormat:    runPackageFormatForTarget(request.TargetOS),
 		BuildJobID:       buildJobID,
 		ArtifactID:       artifactID,
 		KeyGeneration:    key.Generation,
@@ -374,6 +375,11 @@ func (svc *CoreService) ResetComponentKeyForSession(sessionID string, request do
 			return domain.EncryptedComponentKey{}, err
 		}
 	}
+	if request.ComponentKind == domain.DistributionComponentRun {
+		if err := svc.revokeRunControlSessionForInstance(instance); err != nil {
+			return domain.EncryptedComponentKey{}, err
+		}
+	}
 	if err := svc.recordAuditEvent(user.ID, "runtime-key.reset", "server-instance", instance.ID, domain.AuditResultSuccess, "reset "+string(request.ComponentKind)+" key; previous packages revoked"); err != nil {
 		return domain.EncryptedComponentKey{}, err
 	}
@@ -773,6 +779,9 @@ func (svc *CoreService) activeComponentKey(serverInstanceID string, kind domain.
 
 func (svc *CoreService) createEncryptedComponentKey(serverInstanceID string, kind domain.DistributionComponentKind, componentKey string, generation int) (domain.EncryptedComponentKey, string, error) {
 	plainKey, err := randomToken()
+	if kind == domain.DistributionComponentRun {
+		plainKey, err = randomRunComponentKey()
+	}
 	if err != nil {
 		return domain.EncryptedComponentKey{}, "", err
 	}
@@ -1057,6 +1066,11 @@ func validatePluginTarget(plugin domain.GamePlugin, targetOS string) error {
 	return validationError("targetOs is not declared by plugin")
 }
 
+func runPackageFormatForTarget(targetOS string) string {
+	_ = targetOS
+	return "raw-executable"
+}
+
 func packageFormatForTarget(targetOS string) string {
 	if targetOS == "windows" {
 		return "zip"
@@ -1064,6 +1078,13 @@ func packageFormatForTarget(targetOS string) string {
 	return "tar.gz"
 }
 
+func runReleasePlatformURL() string {
+	if value := strings.TrimSpace(os.Getenv("PLATFORM_RUN_RELEASE_URL")); value != "" {
+		return value
+	}
+	return "https://scum.npc0.com"
+}
+
 func distributionID(prefix string, parts ...interface{}) string {
 	values := make([]string, 0, len(parts))
 	for _, part := range parts {