install.sh: preflight check for AVX2 before declaring the stack ready

[pizofreude]

The embedder (BAAI/bge-small-en-v1.5 via fastembed + ONNX runtime) requires AVX2. The README's "Deployment" section says:

"The embedder needs AVX2; schedule daimon-mcp + daimon-indexer onto an AVX2 node."

But no automated check enforces this. On a host without AVX2, the embedder crashes at first Embedder::new() call with a confusing ONNX error long after docker compose up reports success. The user only finds out when they try to do their first recall() and the server falls back to keyword-only — silently, because the system already has a graceful-degradation contract, but with no visible warning.

Proposed change

Two small additions, both backwards-compatible:

1. install.sh preflight (after Docker comes up):

```bash
docker compose exec daimon-mcp sh -c
'grep -q avx2 /proc/cpuinfo
|| { echo "WARN: AVX2 not detected in /proc/cpuinfo";
echo " embedder will fall back to keyword-only recall";
echo " schedule on an AVX2-capable host for hybrid recall"; }'
```

2. daimon-vec startup log (in daimon-indexer):

When is_x86_feature_detected!("avx2") returns false at embedder init, log a single clear line:

```
WARN avx2 unavailable, embedder disabled, recall will be keyword-only
```

…and set embedder = None per the existing degradation contract. The indexer must not crash.

3. Bonus — daimon health should report a recall_tier field: "hybrid" | "keyword" | "unhealthy". The server computes it at startup and on each /readyz call. (Filed separately as a follow-up.)

Acceptance criteria

• A preflight line appears in install.sh output.
• The indexer/embedder logs a clear warning and degrades to keyword-only when AVX2 is absent.
• The README's "Deployment" section references the preflight.

Why this matters

A second user (me, running daimon on a WSL2 openSUSE Tumbleweed host) hit this. The path to diagnosing it was: silent keyword-only recall → read daimon-mcp container logs → grep for "ort" → find the ONNX init error buried in fastembed output. Preflighting AVX2 turns an hours-long mystery into a one-line warning at install time.

[wakbijok]

Shipped in #14, together with #4. Your diagnosis was spot on, and the fix goes one level deeper than the preflight: it turns out the ONNX runtime does not return a catchable error on a non-AVX2 CPU, it dies with SIGILL at first inference. That is why nothing useful appeared at startup. The CPU check now lives inside Embedder::new() itself, so every consumer degrades cleanly:

• install.sh preflights AVX2 after the stack comes up (x86_64 only, arm64 skips it)
• the embedder logs one clear warning and recall falls back to keyword-only, no crash
• the indexer parks instead of restart-looping under compose
• /readyz, /health, and daimon health all report recall_tier (hybrid | keyword | unhealthy), so the degraded state is visible in one curl instead of hours of log grepping
• after moving to AVX2 hardware, daimon reindex backfills the semantic index

If you get a chance to try current main on your WSL2 Tumbleweed host, I would love to hear whether the warning shows up where you expected it. Thanks again for the detailed report, it made this an easy fix to get right.