Rust bundled runtime installation spends avoidable CPU time decompressing gzip archives

Start at the public github_copilot_sdk::install_bundled_runtime() API and the bundled runtime installer described in the issue. Measure matched cold, warm, and repair cases using the pinned runtime and archive identities, including digests, modes, memory, CPU, and release binary size. Done means valid warm verification reads no archive bytes while preserving integrity, permissions, repair behavior, bounded memory, and concurrency guarantees.

Status: architecture first

Following the maintainer's recommendation in #2678, address the architectural installation cost first without adding a decompression backend. #2676 is the owning implementation PR for single-pass streaming and trusted build-generated per-file hashes/metadata that allow valid warm verification without decompressing the archive. Retain the existing miniz_oxide backend and preserve content integrity, permissions, repair behavior, bounded memory, and concurrency guarantees.

The backend experiment in #2678 is now a draft and is deferred. Reconsider zlib-rs only after the architectural work lands and fresh matched cold/warm/repair benchmarks plus release binary-size measurements demonstrate a worthwhile remaining benefit. Earlier measurements against the eager installer are historical evidence, not post-architecture results.

Problem

At upstream revision 9553d5224c73df2d02aee5ec01eeb8353acc736a, the Rust bundled runtime installer traverses the same embedded gzip archive repeatedly and reconstructs large entries even during warm verification. Installer-only measurements show avoidable decompression and allocation costs.

Reproduction

Build the Rust SDK in release mode with its default bundled-cli feature and the pinned shipped runtime. In a fresh process with an isolated HOME, time the public github_copilot_sdk::install_bundled_runtime() API. Repeat with a fresh process against the same valid installation. Do not launch a CLI process, authenticate, or make a model request. Compare cold installation, valid warm verification, same-size corrupted runtime.node, and runtime.node truncated to 1024 bytes.

Evidence required

Use matched source/compiler/profile/runtime/archive identities and repeated alternating before/after processes. Compare output digests, sizes and modes; report latency, CPU, peak and retained memory, and release binary size. Prove valid warm verification reads no archive bytes while still checking installed content against trusted build-generated metadata rather than mutable cache markers.

Deferred backend tradeoff

flate2 documents the byte-slice adapter and backend options at https://docs.rs/flate2/1.1.9/flate2/. zlib-rs requires no C compiler but adds unsafe dependency internals. Any future backend proposal must justify that tradeoff with evidence on the completed architecture, not the old repeated-traversal implementation.