blox-ai: force-update BLOX_AI_MODEL_PATH on OTA + fix chunk cleanup

Two production-rollout fixes caught during lab end-to-end test.

1. install.sh — force-update BLOX_AI_MODEL_PATH:
   Existing fleet devices currently preserve their .env across OTAs
   except for keys listed in FORCE_UPDATE_KEYS (previously empty). On
   the Qwen 2.5 1.5B -> Qwen 3 1.7B model swap, the lab device kept
   its old BLOX_AI_MODEL_PATH=qwen2.5-1.5b-instruct-rk3588-w8a8.rkllm
   even though download_model.sh fetched the new qwen3-1.7b file. The
   container then failed find_model_path() check against the stale
   env var, fell back to MockBackend, and the device silently lost
   real AI capability.

   BLOX_AI_MODEL_PATH must follow the shipped value because the
   filename is dictated by what download_model.sh produces. Trade-off:
   admin overrides to BLOX_AI_MODEL_PATH are wiped on every OTA. That
   is acceptable — model swaps are rare (3 swaps in 6 months) and
   silent breakage is the worse failure mode.

2. download_model.sh — chunk cleanup pattern:
   The cleanup rms used to be `rm -f $MODEL_DIR/chunk-*` which only
   matched the legacy `chunk-aa` naming. The Qwen 3 1.7B model is
   2.21 GB and exceeds GitHub's 2 GiB per-asset cap, so it's split
   into `qwen3-1.7b-rk3588-w8a8.rkllm.part-aa` and `.part-ab`. After
   assembly + SHA verification, the part-* files leaked on disk
   (lab observed +2.3 GB unused). Cleanup pattern now matches both:
     - chunk-*       (legacy)
     - <MODEL_BASENAME>.part-*  (current)

Phase 8 model-swap tests still pass (18/18).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: ehsan6sha

docker/fxsupport/linux/plugins/blox-ai/custom/download_model.sh

@@ -316,7 +316,11 @@ RETRY_COUNT=0
 while true; do
     # Clean any partial state from a prior failed cycle. Done at the top
     # of every cycle so a fresh attempt always starts from a known state.
-    rm -f "$MODEL_DIR"/chunk-* "$MODEL_FILE"
+    # Clean chunk leftovers from prior cycles. Two patterns covered:
+    #   - chunk-*       (legacy naming, kept for backwards compat)
+    #   - <MODEL>.part-* (current naming — split -b produces these for
+    #     2-chunk models that exceed GitHub's 2 GiB per-asset cap)
+    rm -f "$MODEL_DIR"/chunk-* "$MODEL_DIR"/"$MODEL_BASENAME".part-* "$MODEL_FILE"
 
     DOWNLOAD_OK=true
     CHUNK_PATHS=()
@@ -359,7 +363,8 @@ while true; do
                     echo "SHA verified."
                     # Free disk: drop chunk files now that the assembled
                     # file is verified. Chunks are no longer needed.
-                    rm -f "$MODEL_DIR"/chunk-*
+                    # Two patterns: legacy `chunk-*` + current `<model>.part-*`.
+                    rm -f "$MODEL_DIR"/chunk-* "$MODEL_DIR"/"$MODEL_BASENAME".part-*
                     break
                 fi
                 # User override of the .corrupt.<ts> quarantine pattern:
@@ -377,7 +382,7 @@ while true; do
 
     # This cycle failed; clean up + retry the FULL chunk set.
     echo "Deleting bad files; will retry full download."
-    rm -f "$MODEL_DIR"/chunk-*
+    rm -f "$MODEL_DIR"/chunk-* "$MODEL_DIR"/"$MODEL_BASENAME".part-*
     rm -f "$MODEL_FILE"
     if [ $RETRY_COUNT -lt 3 ]; then
         RETRY_COUNT=$((RETRY_COUNT + 1))

docker/fxsupport/linux/plugins/blox-ai/install.sh

@@ -109,7 +109,16 @@ cp "${PLUGIN_EXEC_DIR}/docker-compose.yml" "$BLOX_AI_DIR/"
 #   - Log key names only — never values (some keys hold paths/secrets)
 #   - DOCKER_GID NOT in FORCE_UPDATE_KEYS because the dedicated
 #     dynamic-detection block below sed-updates it from getent.
-FORCE_UPDATE_KEYS=""   # empty by default; add keys here only with cause
+# BLOX_AI_MODEL_PATH MUST be force-updated across model swaps. The
+# shipped value tracks the model that the corresponding download_model.sh
+# fetches; if a device keeps its old path across an OTA, it will look
+# for a file that download_model.sh just deleted (or never wrote).
+# Trade-off acknowledged: admin overrides to BLOX_AI_MODEL_PATH get
+# replaced on each upgrade — admins re-applying a custom model must
+# do so after every fula-ota release. Acceptable because model swaps
+# are infrequent (Qwen 2.5 3B -> 1.5B -> Qwen 3 1.7B were 3 swaps in
+# ~6 months) and silent breakage is the worse failure mode.
+FORCE_UPDATE_KEYS="BLOX_AI_MODEL_PATH"
 
 if [ ! -f "$BLOX_AI_DIR/.env" ]; then
   cp "${PLUGIN_EXEC_DIR}/.env" "$BLOX_AI_DIR/" 2>/dev/null || true