fix(*): resolve releases without spending the github api quota

[arelchan]

Summary

raven upgrade and both installers resolved the latest release through api.github.com
with no credentials. GitHub meters unauthenticated API requests at 60 per hour per IP
address, so every machine behind one office NAT draws down a single shared counter. Once
it is spent, upgrading and installing both stop working:

Unable to upgrade Raven: Client error '403 rate limit exceeded' for url
'https://api.github.com/repos/EverMind-AI/Raven/releases/latest'
... Check your network and try again

The network was fine. The advice sent the user to diagnose the wrong thing, and the same
quota takes down install.sh, which dies with "Could not resolve the latest raven release
wheel". The pending startup update check (24h TTL) adds one request per user per day to the
same shared counter, so this gets worse, not better, as adoption grows inside a company.

This resolves the release from the plain github.com redirect instead:

GET https://github.com/EverMind-AI/Raven/releases/latest
-> 302 location: https://github.com/EverMind-AI/Raven/releases/tag/v0.1.11

That is not the REST API and carries no per-IP API quota. Asset names are deterministic, and
_parse_release_payload already required the wheel URL to be exactly the one the tag implies,
so nothing is lost by not reading the API payload. Downloads never counted against the API
quota, so the whole install and upgrade path can now run without spending any of it.

The API stays as a fallback and now sends GITHUB_TOKEN / GH_TOKEN when either is set,
which moves a developer or CI run onto its own 5000-per-hour quota. An exhausted quota is
recognised from x-ratelimit-remaining and reported with the reset time from
x-ratelimit-reset; UpgradeError grew an optional hint so that message replaces the
generic network advice rather than being appended to it.

Not in this PR: publishing a latest.json next to the hosted installer, which would also
allow staged rollouts and a fast rollback of a bad release. That needs a change to the
release workflow and to what the site serves, so it is worth doing separately.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

uv run pytest tests/test_cli_upgrade_commands.py -> 109 passed. New cases cover: the
redirect is preferred and the API is not called at all; the redirect is never followed even
on a client configured to follow redirects; three malformed redirect shapes each fall back to
the API; GITHUB_TOKEN and GH_TOKEN each produce an Authorization header (and no header
is sent when neither is set); an exhausted quota raises with the limit, the reset time and a
token hint; the hint drops the token advice when a token is already in use; a 403 that is not
a quota failure stays an httpx.HTTPStatusError; and _release_from_tag produces exactly
what _parse_release_payload accepts. One CLI-level case asserts the hint replaces the
"Check your network" line.

install.sh was run end to end against stub uv / node / npm with a curl wrapper that
blocks one endpoint at a time, from a directory that is not a checkout:

curl allowed	resolved wheel	API calls attempted
everything	.../download/v0.1.11/raven-0.1.11-py3-none-any.whl	0
api.github.com blocked	same URL	0
redirect blocked	same URL (via the API)	1

The Python redirect path was also run against the live endpoint:
_fetch_latest_release_via_redirect returned
ReleaseInfo(version='0.1.11', wheel_url='https://github.com/EverMind-AI/Raven/releases/download/v0.1.11/raven-0.1.11-py3-none-any.whl').

• Relevant tests pass locally
• Relevant lint / type checks pass locally (ruff check, ruff format)
• User-facing docs or screenshots are updated when needed

install.ps1 was reviewed by reading, not executed: this was verified on macOS. Its redirect
probe is wrapped so that any failure, including the PowerShell 5.1 behaviour of raising on a
3xx, returns $null and falls through to the previous API path. The worst case is therefore
today's behaviour, not a broken Windows install.

Risk

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

Notes: the wheel URL is still constrained to github.com/EverMind-AI/Raven/releases/download/
by _parse_release_payload, and the tag pattern only accepts vX.Y.Z, so the redirect cannot
point the installer at another host. A token is read from the environment and sent only to
api.github.com. releases/latest excludes drafts and prereleases in both the web and API
forms, so the stability check is preserved. Rollback is a revert of this commit.

Related Issues

N/A