feat: ship single-file run distribution and list key reset

Compile-time run auth replaces zip sidecars, lengthens run keys, revokes
active sessions on reset, and exposes run-key reset in the server list.

platform_web/api/client.test.ts

@@ -132,8 +132,8 @@ const runtimeDownload: ArtifactDownloadReferenceResponse = {
   artifactId: "artifact-run-1",
   ownerKind: "server-instance",
   ownerId: server.id,
-  filename: "run-linux-amd64.zip",
-  contentType: "application/zip",
+  filename: "run-linux-amd64",
+  contentType: "application/octet-stream",
   sizeBytes: 128,
   checksum: "sha256:runchecksum",
   state: "available",
@@ -398,7 +398,7 @@ describe("PlatformApiClient AI providers", () => {
           runEndpointId: endpoint.id,
           targetOs: "linux",
           targetArch: "amd64",
-          packageFormat: "zip",
+          packageFormat: "raw-executable",
           artifactId: "artifact-run-1",
           checksum: "sha256:runchecksum",
           keyGeneration: 1,