fix(workflows): fix silent curl pipe failure in gh-aw install step

The 'Install gh-aw extension' step used `curl ... | bash` which silently
swallows curl failures — when curl can't download the install script (e.g.,
transient network issue), bash receives empty input and exits 0, leaving
the gh-aw binary not installed. This caused intermittent 'Failed to find
gh-aw binary for MCP server' errors in the claude/copilot token analyzer
and optimizer workflows.

Fix: download the install script to a temp file first, then execute it.
This way a curl failure propagates correctly through bash's `set -e`.

Also remove the `-type f` restriction from the binary search so symlinks
are found, and use $HOME instead of ~/ to ensure reliable expansion.

Fixes #2141

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lpcox

.github/workflows/claude-token-optimizer.lock.yml

@@ -14,12 +14,15 @@ steps:
       # Install gh-aw if not already available
       if ! gh aw --version >/dev/null 2>&1; then
         echo "Installing gh-aw extension..."
-        curl -fsSL https://raw.githubusercontent.com/github/gh-aw/refs/heads/main/install-gh-aw.sh | bash
+        # Download to a temp file first so curl failures are detected (avoids silent pipe failure)
+        curl -fsSL https://raw.githubusercontent.com/github/gh-aw/refs/heads/main/install-gh-aw.sh -o /tmp/install-gh-aw.sh
+        bash /tmp/install-gh-aw.sh
+        rm -f /tmp/install-gh-aw.sh
       fi
       gh aw --version
       # Copy the gh-aw binary to RUNNER_TEMP for MCP server containerization
       mkdir -p "${RUNNER_TEMP}/gh-aw"
-      GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+      GH_AW_BIN=$(which gh-aw 2>/dev/null || find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' 2>/dev/null | head -1)
       if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
         cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
         chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"