Add portable tool:asciinema support for standalone executables

[omry]

Summary

Add tool:asciinema as a bindingless portable runtime tool backed by asciinema's official pinned Linux executables.

OmegaFlow will run both Reploy-workload and host-workload recordings from a Reploy-managed controller. Playwright is now supplied by tool:playwright; asciinema should likewise be supplied by Reploy so the OmegaFlow wheel and host no longer need to carry or install the recorder.

Proposed shape

A controller application should be able to declare:

environment:
  applications:
    controller:
      packages:
        tools:
          - tool: asciinema
            version: "3.2.1"

The selected tool should make the validated asciinema executable available to the controller and to child processes it launches.

Required Reploy capability

The current embedded runtime-tool bridge is Playwright-shaped: it requires a Python binding, explicit selections, system-package roots, and archive payloads. Asciinema needs the smaller generic case:

• a runtime tool with no ecosystem binding;
• no symbolic selection;
• no native package roots when the upstream executable is sufficient;
• a pinned raw executable artifact rather than an archive;
• an application-scoped executable export; and
• a controlled runtime-command alias so subprocess lookup resolves asciinema without exposing an entire provider directory or relying on the base-image PATH.

This should use a reviewed Reploy-owned raw-executable acquisition/materialization primitive. Tool definitions must not introduce arbitrary URLs or installer commands.

Initial definition

Use the existing Reploy fixture coordinates for asciinema 3.2.1:

• Linux AMD64: asciinema-x86_64-unknown-linux-gnu
• Linux ARM64: asciinema-aarch64-unknown-linux-gnu

The definition should retain exact upstream version, definition revision, platform, artifact name, URL, byte size, SHA-256 digest, install path, executable export, and probe identity.

Acceptance criteria

• tool:asciinema resolves before acquisition and fails closed on unsupported versions, platforms, targets, or fields.
• Reploy downloads only the definition-selected upstream asset during acquisition, verifies its size and SHA-256 digest, and materializes it with networking disabled.
• The final executable is root-owned/read-only and runs under the configured non-root application identity.
• asciinema --version reports the selected exact version.
• A blueprint command can select the exported executable through the normal application executable contract.
• A controller process can launch asciinema as a child through the controlled runtime-command alias.
• Runtime alias/path state, artifact identity, and definition identity participate in final-image validation, build locks, and cache reuse.
• Linux AMD64 and ARM64 target evidence covers version probing plus a real record and convert cycle around the controlled-session attachment.
• OmegaFlow can remove its vendored asciinema binary and host fallback after consuming this contract.

Non-goals

• Installing an arbitrary user-supplied URL.
• Running curl | sh or another dynamic installer.
• Packaging asciinema inside a Python wheel.
• Depending on distribution-specific APT versions.
• Introducing a custom OmegaFlow controller image.
• Modifying or forking asciinema.