fix(installer): pin phase 3 CLI release

Let Harness sources declare the CLI release tag used by remote installs. Pin Phase 3 to harness-cli-v0.1.4 so branch installs fetch a CLI built from the Phase 3 code instead of the latest main release.

Author: hoangbangnguyen

scripts/README.md

@@ -113,8 +113,11 @@ payload.
 
 By default the installer also downloads the prebuilt Rust Harness CLI for the
 current platform into `scripts/bin/harness-cli` and verifies its `.sha256`
-checksum before making it executable. Set `HARNESS_CLI_BASE_URL` to point at an
-alternate release artifact directory, such as a local `file:///.../dist`
+checksum before making it executable. A source branch can pin the release used
+by the installer through `scripts/harness-cli-release-tag`; Phase 3 pins
+`harness-cli-v0.1.4` so branch installs receive a Phase 3-built CLI. Set
+`HARNESS_CLI_RELEASE_TAG` to override that tag, or set `HARNESS_CLI_BASE_URL` to
+point at an alternate artifact directory, such as a local `file:///.../dist`
 directory created by `scripts/build-harness-cli-release.sh`.
 
 ## Schema Migrations

scripts/harness-cli-release-tag

@@ -0,0 +1 @@
+harness-cli-v0.1.4

scripts/install-harness.sh

@@ -364,6 +364,40 @@ download_file() {
   curl -fsSL "$url" -o "$target" || fail "Could not download $url"
 }
 
+read_cli_release_tag() {
+  local tag_file="scripts/harness-cli-release-tag"
+  local tag=""
+
+  if [ "$SOURCE_MODE" = "local" ]; then
+    if [ -f "$SOURCE_ROOT/$tag_file" ]; then
+      tag="$(awk 'NF && $1 !~ /^#/ { print $1; exit }' "$SOURCE_ROOT/$tag_file")"
+    fi
+  else
+    local tmp_file
+    tmp_file="$(mktemp)"
+    if curl -fsSL "$SOURCE_BASE_URL/$tag_file" -o "$tmp_file" 2>/dev/null; then
+      tag="$(awk 'NF && $1 !~ /^#/ { print $1; exit }' "$tmp_file")"
+    fi
+    rm -f "$tmp_file"
+  fi
+
+  printf '%s\n' "$tag"
+}
+
+default_cli_base_url() {
+  local release_tag="${HARNESS_CLI_RELEASE_TAG:-}"
+
+  if [ -z "$release_tag" ]; then
+    release_tag="$(read_cli_release_tag)"
+  fi
+
+  if [ -n "$release_tag" ] && [ "$release_tag" != "latest" ]; then
+    printf 'https://github.com/hoangnb24/harness-experimental/releases/download/%s\n' "$release_tag"
+  else
+    printf 'https://github.com/hoangnb24/harness-experimental/releases/latest/download\n'
+  fi
+}
+
 install_harness_cli_binary() {
   [ "$INSTALL_RUST_CLI" -eq 1 ] || return 0
 
@@ -598,7 +632,7 @@ if [ -n "$SCRIPT_DIR" ] && [ -f "$SCRIPT_DIR/../AGENTS.md" ] && [ -f "$SCRIPT_DI
 fi
 
 if [ -z "$CLI_BASE_URL" ]; then
-  CLI_BASE_URL="https://github.com/hoangnb24/harness-experimental/releases/latest/download"
+  CLI_BASE_URL="$(default_cli_base_url)"
 fi
 
 if [ "$YES" -eq 0 ] && can_prompt; then