QVAC-23995: migrate vla-ggml to shared @qvac/fabric runtime

[jpgaribotti]

🎯 What problem does this PR solve?

• @qvac/vla-ggml still compiled and bundled the static qvac-fabric vcpkg port, duplicating the ggml runtime and compute backends that @qvac/fabric already ships once per process.
• The package was absent from .github/fabric-consumers.json npm_runtime, so fabric-stack PRs could not validate VLA against PR-built @qvac/fabric prebuilds.
• on-pr-vla still ran verify-qvac-fabric-lockstep and built ROCm/HIP via qvac-fabric[hip-backend] in vcpkg/prebuilds — patterns superseded by the shared npm runtime model used by @qvac/classification-ggml.

📝 How does it solve it?

• Package (packages/vla-ggml, 0.22.0 → 0.23.0):
  • Add @qvac/fabric (^0.6.0); remove qvac-fabric (and hip-backend) from vcpkg.json.
  • Refactor CMakeLists.txt to qvac-addon fabric helpers (qvac_addon_use_fabric, dynamic DT_NEEDED: qvac__fabric@0.bare); drop the static ggml backend install loop.
  • Preload @qvac/fabric in binding.js; resolve ggml backends from node_modules/@qvac/fabric/prebuilds/ on desktop via resolveBackendsDir() (mobile fallback to local prebuilds/).
  • Stage @qvac/fabric for C++ unit tests (qvac_addon_stage_fabric_for_test, relaxed ASAN options).
• CI:
  • Register vla-ggml in .github/fabric-consumers.json npm_runtime.
  • Replace verify-fabric-lockstep with detect-fabric-stack / resolve-fabric-prebuilds on on-pr-vla.yml (mirrors classification-ggml).
  • Thread fabric-overlay-artifact through cpp-tests-vla, prebuilds-vla, and integration-test-vla; remove vla-side ROCm prebuild/lint wiring (HIP comes from fabric prebuilds).

🧪 How was it tested?

Local (linux-x64):

• npm install → @qvac/fabric prebuilds present under node_modules/.
• bare-make generate && bare-make build && bare-make install → prebuilds/linux-x64/qvac__vla-ggml.bare only (no bundled ggml backend .so files); readelf shows NEEDED: qvac__fabric@0.bare.
• npm run test:unit — 6/6 JS tests passed.
• npm run test:cpp — 63 passed, 30 skipped (GR00T/Pi05 oracle fixtures not staged locally); fabric backends staged next to addon-test.
• bare -e "require('@qvac/fabric'); require('./binding')" — binding loads successfully.

CI:

• verify + cpp labels on on-pr-vla (sanity, cpp-lint, cpp-tests matrix).
• prebuilds label — fresh native prebuilds without bundled ggml backends.
• desktop label — integration tests with @qvac/fabric available.
• fabric-stack exercise: PR touching packages/fabric + prebuilds label to confirm overlay path via resolve-fabric-prebuilds.

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.

[github-actions]

License compliance — findings detected (warn-only)

Critical: 0 · High: 4 · Medium: 0

Dependency	License	Scope	Severity	Outcome
@qvac/fabric@^0.6.0	(none detected)	runtime	High	blocks
actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f	(none detected)	runtime	High	blocks
tetherto/qvac/.github/actions/detect-fabric-stack@6620d695d3a07cafe3931182e7844dde376a23f8	(none detected)	runtime	High	blocks
tetherto/qvac/.github/actions/wait-and-download-fabric-prebuilds@6620d695d3a07cafe3931182e7844dde376a23f8	(none detected)	runtime	High	blocks

How to resolve a blocking finding:

• Remove or replace the disallowed dependency, or
• If the license is genuinely acceptable, run the compliance SKILL and record the decision in .github/license-allowlist.yml (CODEOWNERS-reviewed), or
• For a one-off, a maintainer can apply the license-override label (High findings only; Critical cannot be overridden).

Warn-only (shadow) mode — this check does not block merges yet.

Updated automatically by the canonical license compliance workflow.

NOTICE presence (advisory)

Missing NOTICE (advisory, does not block):

• ./.github/actions/release-merge-guard
• ./docs/website
• ./packages/ggml-coload-smoke
• ./packages/fabric/test/integration
• ./packages/inference-addon-cpp/mobile
• ./packages/sdk/e2e
• ./packages/llm-llamacpp/benchmarks/performance
• ./packages/llm-llamacpp/benchmarks/server
• ./packages/vla-ggml/sim/server
• ./packages/embed-llamacpp/benchmarks/performance
• ./packages/embed-llamacpp/benchmarks/server
• ./packages/asr-ggml/benchmarks/server

[github-actions]

Workflow security (shadow mode)

zizmor found 1098 finding(s) in .github/ (highest severity: high). This check is warn-only and does not block the merge.

Findings are annotated inline on the changed files and listed in the job summary.

Reproduce locally:

pipx run zizmor==1.27.0 --offline .github/