fix(install): reuse GitHub release metadata

[bolinfest]

Why

The standalone installers currently perform separate unauthenticated GitHub REST API lookups while resolving the latest version, locating the platform package, locating its checksum manifest, and retrieving asset digests. A single install can therefore make up to four release-metadata requests.

When GitHub's shared unauthenticated rate limit is exhausted, valid releases fail to install. The shell installer also suppresses the metadata request failure while probing assets, so a 403 is misreported as though the release assets do not exist. This makes the failure both more likely and harder to diagnose.

Fixes #28538.

What changed

• Resolve the selected version and fetch its release metadata together.
• Reuse that one metadata response for package, checksum, and legacy-package selection in both install.sh and install.ps1.
• Report metadata fetch failures as possible GitHub availability or rate-limit failures instead of missing assets.
• Add a mocked-curl regression suite covering exact releases, latest, and a simulated metadata 403, and run it in repo-checks.

For latest, the metadata returned by /releases/latest now supplies both the resolved version and the asset list. For an explicitly selected version, the installer makes one request to that release's tag endpoint.

Verification

• python3 -m unittest discover -s scripts/install -p 'test_*.py' -v
• sh -n scripts/install/install.sh
• Parsed scripts/install/install.ps1 with the PowerShell language parser.

Scope

This change reduces GitHub API usage and preserves the underlying error, but it does not move release artifacts away from GitHub's CDN.