Populate the gh release digest manifest from CI so the pinned version is actually enforced

[devantler]

🤖 Generated by the Agentic Engineer

Evidence. #1107 adds the enforcement half of #967: .scripts/ensure-gh-skill.sh now checks a
downloaded cli/cli archive against .scripts/gh-release-digests.tsv, a reviewed version-to-digest
manifest, and .scripts/refresh-gh-digests.sh transcribes rows from the release's published
checksums file. Enforcement is per row, and the manifest ships with no rows, so the gate is
inert for every version we currently install.

Problem. #967's first acceptance criterion is that the expected digest for the pinned REQUIRED
version comes from the in-repo manifest rather than solely from the downloaded checksums file. With
no row for that version, it still comes solely from the checksums file. The substitution #967
describes — a genuinely-attested same-or-newer archive served under the requested version's
asset name — therefore remains possible in practice until a row exists, even though the code that
would reject it is now present and tested (test-ensure-gh-skill-script, cases 8e–8h).

Why it was not done in #1107. Populating a row needs the SHA-256 digests cli/cli publishes on
its release. An unattended agent run may not perform that read: this repository's contribution rules
require the maintainer's explicit confirmation before any read-only action on a repository outside
devantler-tech. The clean resolution is to have CI do the fetch, so the digests enter the
repository through review rather than through an agent's own network read.

Proposed change. A workflow that runs refresh-gh-digests.sh for the currently pinned
REQUIRED version and opens a PR with the resulting rows — the same shape as the existing
update-agent-skills path. Running it on a schedule and on demand also keeps the manifest in step
when REQUIRED is bumped, which is the refresh ergonomics #967 asked for.

Acceptance criteria.

• A workflow populates .scripts/gh-release-digests.tsv for the pinned REQUIRED version and opens
  a PR with the change; no agent performs the upstream fetch directly.
• After it merges, installing the pinned version takes its expected digest from the manifest, and
  the existing test-ensure-gh-skill-script cases stay green.
• Bumping REQUIRED without a matching row still warns and installs rather than blocking, so the
  additive contract in fix(security): pin gh release digests in-repo to close the substitution gap #1107 is preserved.
• The workflow fails visibly if the release publishes no entry for a supported asset, rather than
  writing a partial manifest.

Rough size. Small. The helper and its failure modes already exist and are tested; this is the
CI wiring plus the first populated row.

Part of #967