fix(install): send a default User-Agent with app-source downloads (#2842)

[alcpereira]

Summary

api.github.com answers 403 to requests that carry no User-Agent. App-source downloads have sent none since #1692, so GitHub artifact URLs fail with Failed to download app source: 403.

downloadInstallSource now sends user-agent: agent-device by default. A caller header replaces it in any letter case (for example --header "User-Agent:my-ci"). The default survives cross-origin redirects because crossOriginHeaders already keeps user-agent.

2 files touched (source + its colocated test). No scope expansion.

Closes #2842

Validation

Tested at 2585edbc9:

• New test: a download with no headers sends user-agent: agent-device, and a caller's User-Agent replaces it instead of being joined by a second one. Removing the default fails the first assertion.
• pnpm check:affected --run: all runnable checks passed (358 files, 2255 tests).

Remaining risk: no manual install-from-source run against a GitHub artifact URL. It needs #2840 (#2844) for the direct download path. The repo's own artifacts hold logs, not an installable APK or .app, so I had nothing to install. Command to verify once #2844 lands:

agent-device install-from-source \
  https://api.github.com/repos/<owner>/<repo>/actions/artifacts/<id>/zip \
  --header "authorization:Bearer $GITHUB_TOKEN" --platform android

🤖 Generated with Claude Code

[thymikee]

Reviewed at 2585edb. The fix itself looks correct: downloadInstallSource now sends a default User-Agent, and the regression test fails without the header, so it covers the reported gap.

Issue #2842's completion conditions call for a manual install-from-source run against a real GitHub artifact URL, with the command recorded in the PR. The PR body says that run has not been done, and names #2840/#2844 (the direct-download path) as the blocker. That's an honest gap, not a hidden one, but it does mean the acceptance bar in #2842 isn't met yet.

A repo-wide grep found only one caller of the provision-kit headers, at https://github.com/callstack/agent-device/blob/2585edb/src/commands/install-source.ts#L127, so the new default should cover every download site, but is that the only place headers get attached for this path, or is there another entry point worth checking?

All 13 checks were still queued or in progress when I looked, none failing, and the change stays inside downloadInstallSource without touching daemon routing or other backends, so I wouldn't expect it to interact with anything else in the run.

Once #2840/#2844 land, the manual GitHub-artifact install-from-source run from #2842 should be performed and recorded in this PR before merge.