fix(install): use release registry with GitHub fallback

[betegon]

Summary

A fresh curl install can abort before downloading the CLI when GitHub's anonymous latest-release API returns 403. Resolve the latest stable version from Sentry's existing Craft release registry first, with GitHub as a fallback when the registry request fails, times out, or returns an invalid version.

Limit each metadata request to 10 seconds and show an actionable error with the existing --version override if both sources fail. Binary downloads continue to use versioned GitHub Releases assets.

Test plan

• pnpm exec vitest run test/lib/install-script.test.ts — 23 passed, including registry success with GitHub blocked, fallback, both sources failing, large responses, and pinned-version bypass.
• pnpm exec biome check --write test/lib/install-script.test.ts, bash -n packages/cli/install, and git diff --check passed.
• Real macOS ARM64 and Debian ARM64 installs with the registry blocked succeeded through the GitHub fallback; the installed binary passed --version and --help.
• Full suite/build and other platforms were not run.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cli	Ready	Preview	Sep 28, 2026 8:19am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
sentry-local	Skipped		Sep 28, 2026 8:19am UTC