fix(agentos-apps): read the pack artifact over the VM API instead of a host_dir mount

[tobowers]

Fixes the deployApp() side of #1872.

Problem

Guest-side access to host_dir mounts fails with Permission denied (os error 2) in 0.2.14 — reads and writes, macOS and Linux (minimal repro:
https://github.com/tobowers/agentos-hostdir-repro). The apps pack step runs
guest tar -cf into a writable host_dir mount, so every deploy fails with
agentos_apps_pack_failed:

RivetError: tar failed with exit code 1
metadata: { exitCode: 1, stderr: "tar: Permission denied (os error 2)\n" }

Change

createBuildVm no longer mounts a host output directory. tar writes the
artifact to the guest filesystem (/agentos-app.tar, outside /release so
it never packs itself) and the host reads it back with vm.readFile, which
works correctly. The artifact is read once and cached so artifactSize and
readArtifact don't fetch it twice. This also removes the host temp
directory, its error-path cleanup, and the dispose-time rm from the build
path — one less moving part even after the underlying host_dir bug is fixed.

Verified end to end against 0.2.14 (as a dist patch of this same change) on
macOS arm64 and Linux arm64: hono-only deploys, rivetkit-dependency deploys,
release caching, and failed-build release preservation all behave as before;
only the pack step's transport changed.

Consideration for review

vm.readFile transports the whole artifact over the sidecar bridge in one
call. If bridge read limits cap this below maxBuildArtifactBytes for large
releases, the read may need chunking — happy to adjust if you have a
preferred primitive for large guest reads.

🤖 Generated with Claude Code