anyr update 403 + setup.sh latest 404 for linux x86_64

[duyetbot]

Goal

anyr update (stable and --channel beta) and curl -fsSL https://anyrouter.dev/setup.sh | bash must install/upgrade on linux x86_64 without a GitHub Releases API 403 or a 404 on the download URL.

Context

Repro from the box (2026-08-28):

anyr update
# GitHub Releases API HTTP 403

anyr update --channel beta
# GitHub Releases API HTTP 403

curl -fsSL https://anyrouter.dev/setup.sh | bash
# channel=stable os=linux arch=x86_64
# Downloading https://github.com/anyrouter-dev/cli/releases/latest/download/anyr-linux-x86_64
# curl: (22) The requested URL returned error: 404

Live notes (do not treat as root cause):

• Repo is public. All current GitHub releases are prereleases (v0.1.12-beta.*). /releases/latest HTML 302s; unauthenticated GET https://api.github.com/repos/anyrouter-dev/cli/releases/latest returns 403 from this environment. setup.sh defaults to channel=stable and hits /releases/latest/download/anyr-linux-x86_64.
• Open related: Plan 005: Verify a checksum before replacing the binary during self-update #20 / PR feat(security): verify sha256 of downloaded release assets before replace #30 (checksum before replace). Do not merge release-please PR chore(main): release 0.1.12 #15.

Suggested

Investigate both the CLI update client (User-Agent / unauth API 403 / prerelease-only catalog) and the install script / release asset names so stable and beta channels resolve a real binary. Prefer a durable client+release fix over a one-off published tag unless a missing stable latest is actually required.

Validation

• anyr update and anyr update --channel beta no longer print GitHub Releases API HTTP 403 (success or a clear actionable error).
• curl -fsSL https://anyrouter.dev/setup.sh | bash downloads a real anyr-linux-x86_64 (or the correct current asset name) instead of 404.
• Tests for the 403/404 paths. Open a PR. Do not merge release-please.

[duyetbot]

QA confirmed two live causes (2026-08-28):

1. setup.sh 404: /releases/latest is v0.1.11 with zero assets, so anyr-linux-x86_64 404s. Betas have the binaries (v0.1.12-beta.98).
2. anyr update 403: unauth Releases API is rate-limited from the box; authed is 200.

Fix from that: attach stable assets or stop using empty /latest, and stop calling the API unauth.