ci(canary): use install.sh for CLI setup and add gh to CI image

Author: drew

.github/workflows/release-canary.yml

@@ -72,38 +72,10 @@ jobs:
           fi
 
       - name: Install CLI from GitHub Release
-        run: |
-          set -euo pipefail
-          TAG="${{ steps.release.outputs.tag }}"
-          ASSET_NAME="openshell-${{ matrix.target }}.tar.gz"
-          API="https://api.github.com/repos/${{ github.repository }}"
-
-          echo "Downloading ${ASSET_NAME} from release ${TAG}..."
-
-          # Look up the asset download URL via the releases API
-          ASSET_URL=$(curl -fsSL \
-            -H "Authorization: token ${GH_TOKEN}" \
-            "${API}/releases/tags/${TAG}" \
-            | jq -r --arg name "${ASSET_NAME}" \
-              '.assets[] | select(.name == $name) | .url')
-
-          if [ -z "$ASSET_URL" ] || [ "$ASSET_URL" = "null" ]; then
-            echo "::error::Asset ${ASSET_NAME} not found in release ${TAG}"
-            exit 1
-          fi
-
-          # Download the asset binary
-          curl -fsSL \
-            -H "Authorization: token ${GH_TOKEN}" \
-            -H "Accept: application/octet-stream" \
-            -o "/tmp/${ASSET_NAME}" \
-            "${ASSET_URL}"
-
-          tar -xzf "/tmp/${ASSET_NAME}" -C /tmp
-          install -m 755 /tmp/openshell /usr/local/bin/openshell
-          rm -f "/tmp/${ASSET_NAME}" /tmp/openshell
+        run: ./install.sh
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          OPENSHELL_VERSION: ${{ steps.release.outputs.tag }}
 
       - name: Verify CLI installation
         run: openshell --version

deploy/docker/Dockerfile.ci

@@ -49,6 +49,16 @@ RUN case "$TARGETARCH" in \
       -o /usr/local/lib/docker/cli-plugins/docker-buildx \
     && chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx
 
+# Install GitHub CLI used by install.sh and CI jobs
+ARG GH_VERSION=2.74.1
+RUN case "$TARGETARCH" in \
+      amd64) gh_arch=amd64 ;; \
+      arm64) gh_arch=arm64 ;; \
+      *) echo "Unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
+    esac \
+    && curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${gh_arch}.tar.gz" \
+    | tar xz --strip-components=2 -C /usr/local/bin "gh_${GH_VERSION}_linux_${gh_arch}/bin/gh"
+
 # Install AWS CLI v2 used for ECR publishing
 RUN case "$TARGETARCH" in \
       amd64) aws_arch=x86_64 ;; \