[verified] feat: harden llama.cpp provenance workspace

packages/node/native/llama/PATCH-STACK.md

@@ -15,11 +15,19 @@ loading, endpoint ownership, architecture-defined intermediate boundaries, and
 layer-filtered KV/session mapping. Meshnet routing, Tracker, gRPC, relay,
 billing, authentication, and telemetry must remain outside this directory.
 
-`scripts/llama_cpp_dependency.py` verifies the exact commit/tree and baseline
-blobs, validates every patch digest and context with `git apply --check`, then
-applies the series in `patches/series` order. It refuses a dirty source tree,
-wrong commit/tree/blob, changed patch digest, reordered series, or an existing
-destination/work directory.
+`scripts/llama_cpp_dependency.py fetch` reads the in-repo manifest and checks out
+only its exact commit as detached HEAD in `build/llama.cpp/source`, an ignored
+build workspace. It verifies the exact commit/tree and baseline blobs before use. A
+later offline `fetch` may reuse that cache only after the same clean identity
+verification; an attached branch, tag/repository override, arbitrary destination,
+symlinked workspace, dirty checkout, ignored injected file, or tracked-file
+modification hidden by Git index flags is refused. The tool
+validates every patch digest and context
+with `git apply --check`, then applies the series in `patches/series` order.
+Tracked executable modes are checked physically when Git reports
+`core.filemode=true`; on mounted filesystems without POSIX mode fidelity, the
+locked index tree remains the canonical mode record while every working-file
+blob is independently re-hashed.
 
 ## Current semantic boundary