Revert "fix: replace deprecated GitHub Actions with gh CLI"

This reverts commit 6214303.

fix: properly pass version through workflow and improve tag detection

The gh CLI implementation was broken because:
1. Missing 'version' output from create-release job (critical bug)
2. Other jobs referenced needs.create-release.outputs.version which was undefined

Fixes:
- Add version to outputs in create-release job
- Use GITHUB_REF_NAME for cleaner tag extraction
- Add fetch-depth: 0 to ensure tags are available
- Add debug output to diagnose issues

This should fix the 'untagged-' release creation error.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

fix: replace deprecated GitHub Actions with gh CLI

The actions/create-release and actions/upload-release-asset actions
are deprecated and causing 'Resource not accessible by integration'
errors. Replaced with GitHub CLI (gh) commands which are more
reliable and officially supported.

Changes:
- Create release using 'gh release create'
- Upload assets using 'gh release upload'
- Publish release using 'gh release edit'

This should fix the intermittent release failures.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

fix: detect user's actual shell instead of script's runtime shell

The installer was incorrectly detecting the shell it was running in
(bash/sh when piped) instead of the user's actual login shell. This
caused PATH to be added to wrong profile file (e.g., ~/.bash_profile
for zsh users).

Now prioritizes $SHELL environment variable which correctly identifies
the user's actual shell, only falling back to VERSION checks if needed.

This fixes the issue where zsh users would have PATH added to
~/.bash_profile which zsh never reads.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

auto install to path

fix: use tag-based URLs in release notes instead of main branch

Release notes now reference the specific release tag for installation
scripts, ensuring users get the correct version instead of always
pulling from main branch.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

fix: download OPA with original filename for checksum verification

ignore debug files