fix(ci): make the CLI release pipeline work end to end

[pgherveou]

Four fixes found by dispatching release-cli.yml manually against main, which is the only way to exercise it: it is otherwise gated on a release: commit landing on main. The first three broke the publish; the fourth broke the installed binary on macOS.

1. The runner job had no nightly rustfmt. scripts/codegen.sh formats its generated Rust with cargo +nightly fmt, and only stable was installed. The job is a needs: dependency for the whole matrix, so all three builds and the publish were skipped.

2. sed -n '0,/re/' is a GNU extension. The macOS runner's BSD sed returns nothing, so the darwin leg compared "" against the declared version and bailed. The same expression was in the Makefile, where CI masks it by passing CLI_VERSION explicitly, so make cli-dist on any Mac would have quietly produced truapi-host--aarch64-apple-darwin.tar.gz. Both now use awk -F'"' '/^version = /{print $2; exit}'.

3. The publish job's pattern: cli-* swept in the runner bundle, so runner.js would have been uploaded as a stray release asset next to the archives that already contain it. The artifact is now runner-bundle.

4. current_exe() is not resolved on macOS. It reports the path as invoked, so a binary started through the PATH symlink named that symlink, whose grandparent is .local rather than versions. Every installed copy looked unmanaged: truapi-host update refused to run on a copy the installer had just placed, and the background auto-update silently never ran. Linux reports /proc/self/exe, which is already resolved, which is why the e2e never caught it. Detection now canonicalises first, covered by a regression test over the real symlink chain.

Verification

release-cli.yml now runs green end to end, and the published artifacts install and self-check:

$ curl -fsSL .../truapi-host-installer.sh | bash
$ truapi-host --version
truapi-host 0.10.0
$ truapi-host update
truapi-host 0.10.0 is up to date.

Fix 4 is verified on Linux plus a mutation-checked unit test over the symlink chain; the macOS code path itself is unverified, since I have no macOS runner to install on.

Worth merging before #530, so that release inherits all four.