ci: verify ksail release downloads

[devantler]

Motivation

• Prevent execution of an unverified, network-downloaded KSail binary in production deploy and CI paths that had access to high-value secrets and cluster credentials.

Description

• Add a shared installer script .github/scripts/setup-ksail.sh that downloads the pinned KSail release asset and verifies its sha256 digest from the GitHub release metadata before extracting and installing the binary.
• Replace inline curl | tar | sudo install KSail steps with calls to the verified installer in .github/actions/deploy-prod/action.yml, .github/workflows/ci.yaml, and .github/workflows/dr-rebuild.yaml so the asset is validated before any credentials are written or ksail is invoked.
• Keep the existing Renovate # renovate: pins and metadata-based tracking for KSAIL_VERSION while adding runtime integrity checking to the install path.
• Commit created with message ci: verify ksail release downloads (HEAD: 1f9a0400).

Testing

• Run git diff --check and bash -n .github/scripts/setup-ksail.sh with no syntax errors, which succeeded.
• Validate YAML parsing of modified action/workflow files with a Ruby YAML load, which succeeded.
• Perform a mocked install run (PATH-shimmed curl/sudo/ksail) that exercised release JSON parsing and sha256sum --check, which verified the digest and simulated a successful install.

---

Codex Task

[devantler]

Requested by the 🤖 Daily AI Engineer — CI is green at the current head and this draft carries no qualifying review, so requesting the lane-priority reviewer. Hygiene only: this is a sibling lane's draft and its owner promotes it.

[devantler]

@cursor review

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_1112ba5d-85be-4bd3-a638-b5ff56ffb1fd)