update: releases come from one repository; retire the former-name fallback

[ZeroPoint95]

Releases now come from one repository only: the updater and the curl installer stop asking the repository's former name after a 404.

What changed

• internal/update no longer asks the former name after a 404. A 404 from Agent-Field/codeaf is now final for:
  • picking a release (Select)
  • looking up a release's publish date (TagPublished)
  • downloading it (Install)
• Install always downloads from Agent-Field/codeaf, even when the caller set a different repository on the release.
• scripts/install.sh: the same fallback is removed from the release lookup and the download. Its own comment said it was meant to go after one release.
• Kept: the former asset file name, still tried within the same release. Only v0.1.0 (the one stable from before the rename) uses it, and its checksums.txt still verifies it.
• Why:
  • The former name has the same GitHub repository id as Agent-Field/codeaf. It is only a redirect, so it never had a release the real repository lacks.
  • If a repository were ever created under the old name, GitHub would stop redirecting, and the old fallback would have trusted it.
  • Raised as a security note in the review of update: a released codeaf installs the newest stable and restarts before the chat opens #1826.

How it was checked

• gh api repos/Agent-Field/<former name> and gh api repos/Agent-Field/codeaf return the same repository id.
• Every stable and rc release is in Agent-Field/codeaf. Only v0.1.0 and the old build-* tags use the former asset name.
• go test ./internal/update/: ok (11.2s). New tests:
  • TestANotFoundFromTheReleaseRepositoryIsTheAnswer: a 404 fails Select, TagPublished and Install, and no request goes to any other repository.
  • TestTheFormerAssetNameStillInstallsTheOneOldRelease: v0.1.0 installs under its former asset name from the same repository.
• go test ./internal/release/ (the shell installer):
  • TestInstallerAsksOnlyTheReleaseRepository: the fake also answers under the former name, yet the install fails and nothing is asked there.
  • TestPinnedFormerReleaseTakesItsFormerAssetFromTheReleaseRepository.
  • Every other test passes too, except TestTheReleaseSurfaceTestSurvivesEveryLedgerState. It fails with test_args[@]: unbound variable under macOS's bash 3.2, and fails the same way on origin/dev 1acf751.
• make test-quick: passes.
• make test-touched: exit 0. internal/update passes; the one internal/release failure is reported as "already failing on the base".

Checklist

• A change entry: docs/changes/unreleased/1832-one-release-repository.md
• The manual knows about it: no change needed. No page ever said the fallback existed, and no command, key, default or refusal wording moved.
• No .github/known-red.txt entry (the ledger no longer exists; removed in provider, cmd/aforge: the last loose locks hold their mutex from a defer (review needed) #1012)
• Only my own paths are staged — no git add -A

🤖 Generated with Claude Code