fix: build enpass-cli from pinned commit and stop reporting false success

[wpfleger96]

Two fixes surfaced by an enpass-cli install that failed but still printed ✓ Package installation complete.

enpass-cli install. The pinned install ran gh release download --repo hazcod/enpass-cli --tag v1.12.0, but gh release download takes the tag positionally, so it never succeeded on either platform. Fixing the flag alone isn't enough: v1.12.0 lacks -exact, which load-tf-secrets uses for the AWS lookups, and upstream hasn't published a release since because its release build fails on the Windows targets. Both platforms now build from upstream commit cfb4a83:

• go install ...@<full sha> with -X main.version=cfb4a83, so the version/version_cmd drift check still works (the binary logs version=cfb4a83 to stderr, which the check reads).
• New prerequisites: Go >= 1.25 and a C compiler (go-sqlcipher needs cgo). The command prechecks go with a clear message and sets CGO_ENABLED=1 so a missing compiler fails the build instead of producing a binary that can't open vaults. Go's install dir is prepended to PATH (/usr/local/go/bin on Linux, Homebrew bins on macOS) and the temp build dir is cleaned up via trap.
• load-tf-secrets's "not found" hint now points at shell-configs install (which installs Go) rather than packages install.

Once enpass-cli#163 merges and v1.13.0 is published, this can go back to gh release download v1.13.0 --repo hazcod/enpass-cli.

False success reporting. install discarded every Component.apply() result, and several apply() implementations returned True after failures.

• Components: RequiredPackagesComponent, OptionalPackagesComponent, ConfigsComponent, and ExtensionsComponent return False on any failure; ScriptsComponent prints the install/orphan-removal errors it used to discard. ConfigsComponent counts OperationResult.ERROR across configs, additional files, orphan removals, preferences, and state-DB writes, and state-DB results are keyed per database so a VS Code error isn't overwritten by a Cursor success on the same key.
• install's body is now run_install(ctx, components) -> bool. The command prints Install completed with errors and exits 1 on failure; setup and upgrade call run_install directly instead of catching SystemExit. A component that raises in any stage is reported and counted as failed while the remaining stages still run, and parallel spinners show (failed) when apply() returns False.
• setup step 1 now installs only required packages and languages; optional packages (enpass-cli needs Go) are installed in step 3 after languages, so a fresh machine doesn't end in a spurious failure. Script install errors are reported, and setup ends with Setup completed with errors + exit 1 when anything failed. Having no package manager still aborts setup.
• upgrade exits 1 when a version/update check or an upgrade fails, and prints Upgrade succeeded, but applying configs reported errors when only the follow-up install failed.
• packages install/uninstall share a print_batch_summary helper (N installed, M failed) and exit 1 on failure; configs install and cleanup (partial backup removal) exit 1 too.

Behavior change: install, and therefore upgrade, now exit 1 on machines where gh auth or its required OAuth scopes are missing, including non-interactive runs, since GhAuthComponent reports that as a failure.

Related: enpass-cli#163