fix: resolve "latest" without api.github.com

[mario4tier]

api.github.com allows 60 requests/hour per IP, and GitHub-hosted runners
share IPs. On a busy hour the version lookup gets a 403 and the action dies —
this reddened an unrelated PR on ta-lib-python today. Worse, curl and
python3 ran in a pipeline, so the visible error was a JSONDecodeError, not a
rate limit.

Before

VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" \
          | python3 -c "import sys,json; print(json.load(sys.stdin)['tag_name'].lstrip('v'))")

After — github.com's /releases/latest redirect, which GitHub documents and
which carries no rate-limit quota:

LOCATION=$(curl -fsS --retry 3 -o /dev/null -w '%{redirect_url}' \
             "https://github.com/${REPO}/releases/latest")
TAG="${LOCATION##*/tag/}"
VERSION="${TAG#v}"

No API, no quota, no JSON parser.

It is the common pattern

Shell installers avoid the API rather than authenticate it. golangci-lint,
trivy and syft all resolve "latest" from github.com — grep -c api.github.com is 0 in all three install.sh files. (They use the
Accept: application/json variant of the same URL; the redirect used here is
the form GitHub actually documents, under "Linking to releases".)

Tested

Resolution, against live repos:

repo	resolved
TA-Lib/ta-lib	0.7.1
golangci/golangci-lint	2.13.2
aquasecurity/trivy	0.74.0
cli/cli	2.100.0

Failure modes stay loud, which matters most — a wrong version installs silently:

• nonexistent repo → curl: (22) ... 404, exit 22
• repo with no releases (actions/toolkit) → redirect has no /tag/, so the
  guard fires with a clear message rather than returning a bad version

Also here

• --retry 3 on the three asset downloads, for transient 5xx and timeouts. No
  --retry-delay, so curl keeps its own exponential backoff.
• .github/workflows/test.yml — the action had no CI, so it has never actually
  been exercised. Installs on ubuntu/macos/windows × latest/0.7.1, and checks
  the reported version against the installed header.

[mrjbq7]

Rad!