action.yml: harden release download path (output sanitization + checksum)

[ifireball]

Summary

Harden the shell-side install path in action.yml (Detect install method / Download release binary) for parity with the Go-side release downloader and to address review findings on PR #1954.

Background

PR #1954 (--vendor) merged recent main changes including #2053 (source-build fallback in action.yml). The vendor PR only changes the vendored-binary comment; the detect/download steps are shared infrastructure flagged by fullsend-ai-review:

1. GITHUB_OUTPUT injection — When resolving latest, the release tag from the GitHub API is written to step outputs without tr -d '[:space:]' sanitization (unlike direct inputs.version). A tag containing newlines could corrupt $GITHUB_OUTPUT.
2. No checksum on shell download — The "Download release binary" step fetches and extracts a tarball over HTTPS without verifying SHA256 against release checksums.txt, unlike internal/binary/download.go (DownloadRelease).

Scope

• Sanitize API-resolved TAG (and derived outputs) before writing to $GITHUB_OUTPUT; prefer heredoc-delimited output syntax where appropriate.
• After downloading the release tarball in the shell step, verify SHA256 against the published checksum file (same asset naming as Go path).
• Add tests or a documented manual verification checklist if automated testing of composite action shell is impractical.

Non-goals

• Changing vendored-binary detection (--vendor install paths).
• Re-litigating source-build fallback (action.yml: fall back to building from source when version has no published release #2026 — implemented in build(action): action.yml now compiles from source if not release #2053).

Tracking

• Raised from fullsend-ai-review on PR feat(install)!: add --vendor for self-contained workflow and agent assets #1954 (commits 52dc9d26, 893d1af9).
• Related: action.yml: fall back to building from source when version has no published release #2026 (source-build fallback), TestResolveLinuxBinary_Download should not make live HTTP calls to GitHub CDN #2002 (Go download test hygiene).

[fullsend-ai-prioritize]

RICE Priority Score: 1.6

Score breakdown

Dimension	Score	Reasoning
Reach	2	The action.yml install path is shared infrastructure used by all users who install fullsend via the GitHub Action. The output sanitization and checksum gaps affect everyone using the detect/download steps, scoring as most active users across orgs.
Impact	1	These are security hardening measures rather than fixes for actively exploited bugs. The GITHUB_OUTPUT injection requires a maliciously crafted tag (unlikely in practice), and the missing checksum is a defense-in-depth gap. Workarounds exist (pinning versions, using Go install path). This is a noticeable improvement to security posture but not blocking workflows.
Confidence	0.8	The issue is very well-described with specific technical details, clear scope, explicit non-goals, and references to the originating review findings. The changes needed are well-understood.
Effort	1	Well-scoped to action.yml shell steps: adding tr/heredoc sanitization for tag outputs and a SHA256 checksum verification step against the published checksums.txt. Touches a few files with clear patterns from the existing Go-side implementation to follow.

Formula: (2 x 1 x 0.8) / 1 = 1.6