fix(os): harden elizaOS smoke checks and USB installer boundary

[NubsCarson]

Summary

• make elizaOS Live static smoke mode checks stable in shared Git worktrees by reading executable modes from the Git index before falling back to filesystem modes
• keep raw USB/disk platform backends out of the Vite renderer bundle; the installer UI now talks through the local HTTP/IPC backend contract
• fix Android release validation by keeping strict manifest checks as the default while making the checked-in pre-release placeholder mode explicit with --allow-placeholders
• document the USB installer privileged-helper boundary and Android draft-vs-publish validation split
• include the homepage Biome formatting fix surfaced by CI

Verification

• node --check packages/os/scripts/*.mjs
• node packages/os/scripts/validate-release-manifest.mjs --manifest packages/os/release/beta-2026-05-16/manifest.json
• node --test packages/os/scripts/__tests__/os-release-scripts.test.mjs
• packages/os/android/installer/tests/run-tests.sh
• node packages/os/android/installer/scripts/validate-release-manifest.mjs packages/os/android/installer/manifests/android-release-manifest.example.json
• node packages/os/android/installer/scripts/validate-release-manifest.mjs packages/os/release/beta-2026-05-16/android-release-manifest.json --allow-placeholders
• bun run --cwd packages/os-usb-installer build
• bun run --cwd packages/os-usb-installer test
• bun run --cwd packages/os-usb-installer lint
• bun run --cwd packages/os-usb-installer typecheck
• bun run --cwd packages/homepage format:check
• bun run --cwd packages/elizaos-setup typecheck
• bun run --cwd packages/elizaos-setup build
• bun run --cwd packages/os-homepage lint:check
• bun run --cwd packages/os-homepage typecheck
• bun run --cwd packages/os-homepage build
• ELIZAOS_STATIC_SOURCE_ONLY=1 ./scripts/static-smoke.sh
• ./scripts/security-smoke.sh (passes with expected production warnings for missing update keyring and SBOM/provenance artifacts)

Notes

• This is a follow-up to the merged elizaOS Live PR feat(os): validate elizaOS live USB demo path #7776.
• It does not rebuild or attach a new ISO; it tightens source validation and fixes the OS release validation failures.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a24773a9-c686-4955-aaa4-1a0214ac40eb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch nubs/elizaos-live-followup

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}