Record the paired ggml commit as a first-class manifest field

[danielhanchen]

Summary

Records the paired ggml commit as a first-class field in the whisper prebuilt manifest, so the slim pairing key is explicit rather than only implicit in the llama tag string.

Slim bundles are ggml-less: whisper-server links the ggml runtime (libggml.so.0, libggml-base.so.0, backend modules) out of the paired unslothai/llama.cpp prebuilt. llama fork tags are b<upstream_build>-mix-<ggml_commit>, and the -mix-<ggml_commit> suffix is the ABI the slim bundle links against; the build number only tracks upstream llama and fork PRs outside ggml. The Studio installer therefore pairs on the ggml commit, not the whole tag, so a newer llama build that keeps the same ggml still backs the bundle.

Change

scripts/package_bundle.py derives the ggml commit from the paired llama tag and records it:

• paired_ggml_commit at the manifest top level.
• requires_ggml_commit on each slim artifact entry.

Both come from the same llama_tag the bundle was built against, so they cannot disagree with requires_llama_tag. The change is additive and backward compatible: consumers that read requires_llama_tag / requires_ggml_sonames are unaffected. The README manifest schema and pairing notes are updated to document the field and the ggml-keyed pairing.

Context

This is the belt-and-suspenders companion to the Studio installer fix (unslothai/unsloth#7381), which relaxes the pairing gate to key on the ggml commit. That PR fixes the live symptom (curated dictation going unavailable when llama advances to a newer build with the same ggml); this PR makes the ABI key first-class and auditable in the manifest for any future consumer.

Testing

No Python tests exist for package_bundle.py; the paired_ggml_commit helper was smoke-tested directly across the real tag forms (b10079-mix-fb3d4ca to fb3d4ca, b10043-mix-0ac9dfb to 0ac9dfb, non--mix- and empty inputs to null). The manifest and sha256 sidecars are regenerated by the release workflow from the bundles' embedded info, so the field flows into the next published release.