feat: install LLGo releases and refs across native platforms

[cpunion]

LLGo installation previously built every selected version from source using hard-coded Go 1.20 and LLVM 18, and reused/deleted ~/workdir. This change installs current LLGo on native Linux, macOS and Windows hosts without touching existing user directories.

• Preserve exact versions, version prefixes, SemVer ranges and branches; add explicit refs, tag/branch globs, full commits and unambiguous abbreviated commits. Annotated tags resolve to their commit SHA.
• Prefer the matching precompiled release archive, verify its SHA-256, and fall back to source only when the release/asset is absent. Allow explicitly selecting release or source.
• Support plain LLGo version files and // llgo directives in go.mod/go.work, plus go-version-file, following setup-xgo input conventions. Verify the installed release patch version.
• Expose Go/LLVM versions, host architecture and Windows MSVC/MinGW ABI. Export the installation root, selected ref, resolved commit and actual installation method.
• Adapt Windows dependency/ABI setup from LLGo's own CI, with attribution, and cache Go dependencies/build outputs against LLGo dependency files and the resolved source revision.
• Retry transient metadata/archive transfer failures with bounded 1s/2s backoff; keep HTTP, checksum and filesystem failures fatal. Test Node.js 20 and 24 on all three systems.
• Replace the old test that invoked the real home-directory installer with isolated Git fixtures and mocked downloads. Tests now propagate failures.

Validation:

• 60 tests pass; TypeScript, ESLint, formatting and actionlint checks pass.
• The rebuilt action installs the latest LLGo main locally and passes both a native smoke test and the complete llcppg LLGo coverage suite.
• CI tests release and source installation on Linux/macOS amd64/arm64 and Windows amd64/arm64 with both MSVC and MinGW (16 native lanes). Every lane runs llgo test and a compiled executable; Windows also checks the target triple. Selector jobs exercise prefixes, patterns, ranges and commit forms.

This action is consumed by llcppg#854, whose macOS and Ubuntu LLGo coverage tests both pass.

Compared with setup-xgo: preserve its existing SemVer/branch and version-file conventions while adding commit selection, precompiled releases, proper composite output mappings, and explicit native architecture/ABI execution checks.

The final upstream 27-job CI matrix passes: 16 native release/source installations, five selector jobs, and six Node.js 20/24 test jobs across Linux, macOS and Windows. Lint and generated-bundle checks also pass.

[fennoai]

Review Summary

This is a substantial, well-executed rewrite of the install path. Strong improvements over the prior code: version resolution moved to a strict, well-tested allow-list (resolve.ts), git commands migrated from string-interpolated execSync to argument-array execFileSync (removing the shell-injection surface), SHA-256 checksum verification added for release downloads, HTTPS-only downloads with a redirect cap, and the old bug that rmSync'd the user's ~/workdir is gone. Test coverage in resolve.ts/install.test.ts/platform.test.ts is thorough, including command-injection-style inputs.

Findings are mostly low severity; none are blocking. The highest-value item is the download timeout gap (inline on src/download.ts).

Additional (no reliable inline anchor):

• Documentation — README.md:63 — "Hosted runners supply Node.js 20+" is an unverified/unenforced minimum. This same PR standardizes every CI/lint workflow on Node 24, and there's no engines constraint or runtime check enforcing the stated floor. Either verify/document the true minimum or align the wording with Node 24 so self-hosted-runner operators aren't misled.
• Retry/backoff consistency — download() (src/download.ts) and the release-metadata fetch (src/install.ts) have a timeout but no bounded retry, while the workflow invests heavily in retries elsewhere (curl --retry, pacman_with_retry). A single transient blip fails the whole multi-minute job. Consider a small bounded retry on these two network operations. (404/non-2xx correctly short-circuit and should not be retried.)

Nice work overall.

[cpunion]

Addressed the two additional findings in the review summary in 16e5471:

• Node.js minimum: package.json already declares engines.node >=20; README now states the requirement explicitly, and the unit/integration tests run with Node.js 20 and 24 on Linux, macOS and Windows.
• Network retries: release metadata and archive downloads now retry only transient transport failures/timeouts, at most three attempts with 1s/2s backoff. Metadata fetches have a 120-second timeout including body reads. HTTP errors (including 403/404), invalid checksums and filesystem errors are not retried. Tests cover wrapped fetch failures, a reset during the streamed archive body, replacement of partial files, the retry limit/backoff, and permanent failures.

All 60 tests pass on Node.js 20 and 24 across Linux, macOS and Windows. TypeScript, ESLint, formatting, actionlint and the rebuilt bundle check pass. The final upstream 27-job CI matrix passes, including all eight OS/architecture/ABI combinations through both release and source installation, plus the five selector jobs. llcppg CI also passes on macOS and Ubuntu using this exact action commit.