fix(cli): install native Linux Desktop tarballs

[DamianReeves]

Summary

Finish the installed Desktop acceptance work for morphir-ds9e.3.2.

Real Linux packaging exposed a missing-executable failure: electron-builder wraps tar entries in
morphir-desktop-<version>-linux-<arch>/, while local installation declared a root-level executable.
Derive the correct path from the validated version and target platform, not the downloaded
filename. This supports renamed archives, ARM64, x64, and preview versions.

Linux lifecycle integration fixtures now use the real tar directory layout and a renamed archive
instead of a raw executable. Companion UI release metadata received the same correction in
finos/morphir-ui#33, now landed and pinned here at
92d5471a9ceda5d771a8d17ed5cc1a4c2c1aec20. The Bun TypeScript demo remains unchanged.

Verification

• Regression failed before the fix on native Windows and Linux.
• Native Windows: 279 unit tests, 60 CLI integration tests, strict Clippy and formatting passed;
  2 existing external-tool integration cases ignored locally.
• Linux ARM64: 297 unit tests and 9 Desktop-focused integration tests passed.
• 9 Bun demo orchestration tests passed.
• bun run tools/demo-desktop.ts --prepare-only built, packaged and installed a real Linux
  ARM64 Desktop successfully using the corrected CLI.
• Earlier native Windows ARM64 demo passed both interactive launches with normal exit 0.
• After rebasing onto main 3147cd41 and aligning its Rust submodule pin, native unit tests,
  all 60 enabled CLI integration tests, and strict all-target Clippy passed again.

Real isolated acceptance

The installed Linux ARM64 Desktop passed two GUI launches using morphir desktop --offline --wait.
Each displayed the selected sample model and applyLambda in Insight and XRay, then closed
normally with exit 0.

Bubblewrap mounted only installed files, the sample model, system libraries/configuration and
the WSLg display socket. The checkout, build snapshot and original package were not mounted.
A new network namespace had no routes. Positive host file/TCP controls succeeded; isolated
controls failed. Running Desktop process audits confirmed the same isolation. Electron's
sandbox was not disabled and no global network/security setting was changed.

Package SHA-256: 504a9305eb867ead794c79757d35d573e9e4c6366afecb828d9e271bf3f4f04e, 71 verified files.

• First: op-8b4ccc92-539f-4e48-95d9-c09153909efd, launch-e0077078-b36e-4369-83eb-40e0cb6181bd.
• Repeat: op-29cef130-5b6d-4fbb-9c1f-e2a2860c70af, launch-2a257dfb-4856-48b7-b5c7-263046d2b669.

Both CLI and Desktop logs contain matching ready and exit records. Strict isolation was tested
on Linux under WSL2; native Windows GUI acceptance is separate evidence.

No follow-up story was created to defer a defect from this task.

[netlify]

✅ Deploy Preview for angry-raman-7c44f6 canceled.

Name	Link
🔨 Latest commit	32b9fe8
🔍 Latest deploy log	https://app.netlify.com/projects/angry-raman-7c44f6/deploys/6a981fb04529bd0008a3390d

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T13:10:48.095504Z	32b9fe8	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[DamianReeves]

Companion UI release metadata fix: finos/morphir-ui#33. The UI landed commit will be pinned here before merge. @codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: b27572627e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[DamianReeves]

UI #33 has landed at 92d5471a9ceda5d771a8d17ed5cc1a4c2c1aec20 after all CI and packaging checks passed. The new commit only pins that reviewed, landed UI tree. The earlier parent review completed without findings. Native post-rebase unit/integration tests and strict Clippy pass. Please review the final head. @codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 32b9fe886d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".