feat(awf-cli): migrate to public repo direct install

[pocky]

Summary

• Migrate awf-cli devcontainer feature from a private-repository deferred install pattern (requiring gh CLI auth and a postCreateCommand) to a direct build-time install from the now-public awf-project/cli GitHub releases
• Add version option to support pinning a specific release (e.g. 0.9.0), resolving latest automatically via the GitHub API
• Add SHA256 checksum verification on every install for supply-chain integrity
• Remove all private-repository scaffolding: awf-install helper script, github-cli dependency, gh auth test scenario, and host config mount instructions

Changes

Feature Metadata

• src/awf-cli/devcontainer-feature.json: Bump to 2.0.0, add version option with latest default, add documentationURL/licenseURL, remove github-cli from installsAfter

Install Script

• src/awf-cli/install.sh: Full rewrite — direct build-time download from public GitHub releases, architecture detection, GitHub API version resolution, SHA256 checksum verification, binary installed to /usr/local/bin/awf

Tests

• test/awf-cli/test.sh: Replace awf-install helper assertions with direct awf binary and awf version checks
• test/awf-cli/install_awf_cli_latest.sh: Simplify to source test.sh (no custom logic needed)
• test/awf-cli/install_awf_cli_specific_version.sh: New scenario validating version pinning with v0.9.0
• test/awf-cli/install_awf_cli_with_gh_auth.sh: Deleted — gh authentication no longer required
• test/awf-cli/scenarios.json: Replace install_awf_cli_with_gh_auth (with github-cli dependency) with install_awf_cli_specific_version

Documentation

• README.md: Remove private-repository warning, host mount instructions, and deferred install explanation; add version options table and version-pinning example

Test plan

• Run ./test-local.sh awf-cli — all three scenarios (install_awf_cli_latest, install_awf_cli_specific_version, base) should pass
• Verify awf version outputs a version string (e.g. awf version 0.9.0) inside the container
• Verify install_awf_cli_specific_version installs exactly v0.9.0 and not a newer release
• Confirm no gh CLI or host mounts are required in a plain devcontainer.json referencing this feature

---

Generated with awf commit workflow