installer: add explicit --install-runtime for the pinned CPU Python runtime (D4)

Creates a user-local venv under $XDG_DATA_HOME/frameyap/runtimes from the
invoking python3 (3.10-3.13), installs CPU torch==2.8.0 from PyTorch's CPU
index and moondream==2.4.0 from PyPI (binary wheels only, pip --isolated,
Torch constrained), verifies imports and no CUDA, then sets python= in
paths.conf and removes superseded managed runtimes. Requires --yes; has a
read-only --print-plan/--json. A failure removes only the new venv.

Offline tests mock pip; a real run passed on x86-64 Python 3.12. ARM64 Frame
install is still pending.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/worker.md

@@ -80,8 +80,9 @@ flags do not prove every third-party internal is unable to access a network.
 Runtime/build/tests perform no downloads; the separate explicit setup utility
 `scripts/fetch-model.py` can provision the public pinned weights.
 
-Current native-only archives do not bundle or pip-install the runtime; see
-[third-party notes](third-party.md). No public runtime bundle has been released.
+Native-only archives do not bundle the runtime; the explicit
+`install.sh --install-runtime --yes` step pip-installs it into a user-local venv
+(see [packaging](packaging.md) and [third-party notes](third-party.md)). No public runtime bundle has been released.
 Limited ARM64 measurements were taken during development; they are not a claim
 of complete headset acceptance.