Add AWF installer fallback when pinned firewall release is missing

[Copilot]

Compiled workflows can pin an awf version that later disappears from github/gh-aw-firewall releases; install_awf_binary.sh currently hard-fails on checksums.txt 404, aborting before agent execution. This change makes installation recover by falling back to the latest available AWF release when the pinned release is missing.

• Installer resilience for missing pinned releases

  • In actions/setup/sh/install_awf_binary.sh, added version/url indirection via set_release_urls.
  • Added download_checksums_with_fallback:
    • probes pinned checksums.txt with HTTP status handling,
    • on 404, resolves releases/latest,
    • rewrites install URLs to the latest tag and retries checksum download.
  • Preserves checksum verification and existing install paths (bundle-first, then platform binary).

• Operator-visible diagnostics

  • Emits explicit messages when pinned version is unavailable and when fallback version is selected.
  • Clarifies terminal error when pinned version is also latest but still lacks checksums.

• Focused shell coverage

  • Added actions/setup/sh/install_awf_binary_test.sh to simulate pinned-release 404 and assert fallback-to-latest behavior.

# New behavior in install_awf_binary.sh
status=$(curl ... -w '%{http_code}' "${CHECKSUMS_URL}")
case "$status" in
  404)
    latest_version=$(resolve_latest_version)
    set_release_urls "$latest_version"
    curl ... -o "${TEMP_DIR}/checksums.txt" "${CHECKSUMS_URL}"
    ;;
esac