Host: install verification builds through Host, including private GitHub Actions artifacts #3268

Part of #3264. ADR 0021 §6. Design D6 in the umbrella.

Blocked by: #3265
The route policy from #3266 applies on top.

Purpose

A verification worker installs the exact CI build of a PR through Host, including builds stored as private GitHub Actions artifacts. It must not be able to point Host at files on the Host machine.

Required behavior

• install-from-source <url> works through Host as it does through proxy, for public hosts only.
• install-from-source --github-actions-artifact owner/repo:artifact works through Host. The daemon looks the artifact up through the GitHub REST API by id, by run and name, or by the newest live artifact with that name from the repository's own runs, never a fork pull request. It authorizes with AGENT_DEVICE_GITHUB_TOKEN from its own environment, sends the token only to an archive URL under the named repository, and hands that URL to the existing approved downloader, which drops the Authorization header at the cross-origin storage redirect.
• AGENT_DEVICE_GITHUB_REPOSITORIES can limit which repositories the daemon token reads. A client holding a token refuses to reuse a daemon started without it or with another one.
• Requests never carry a GitHub credential. The token is never written to daemon.json, logs or responses.
• Typed refusals: github-token-missing, github-token-rejected, github-repository-not-allowed, github-artifact-not-found, github-artifact-expired, github-artifact-url-unexpected, github-api-refused, github-api-timeout.
• A client-supplied Host path is still refused with host-path-refused from Host: strip client identity, hand the principal to the daemon over loopback, enforce the public route policy #3266.

Completion conditions

• Tests with the network transport mocked: the lookup sends the daemon token, the storage redirect does not, and a missing token, a missing artifact and an expired artifact each get their typed refusal.
• A test shows URL and artifact sources reach the daemon through Host.
• A live iOS simulator run installs a real GitHub Actions artifact, opens the app and takes a snapshot, following docs/agents/device-verification.md. The PR records the commands and the result.

Dependencies

#3265, and #3266 for the path refusal.

Example

# on the Host machine
AGENT_DEVICE_GITHUB_TOKEN=... agent-device host --port 8443
# on the worker
agent-device install-from-source --github-actions-artifact callstack/app:ios-sim-build --platform ios