toolkit merge: CLI dual-source upgrade + install-script parity

[BYK]

Sub-task of the toolkit monorepo merge (master issue linked below). Plan: https://gist.github.com/BYK/8c0ce6cec64608f41fe5654b7827228e

CLI self-upgrade backward/forward compatibility (highest correctness risk).
Old binaries have getsentry/cli + ghcr.io/getsentry/cli baked in and will hit
those endpoints forever.

• Dual-source resolver (UPGRADE_SOURCES: primary toolkit, fallback getsentry/cli, fall back on 404) across src/lib/binary.ts, ghcr.ts, upgrade.ts, delta-upgrade.ts.
• Mirror the same fallback in the install script; add a check: script asserting install-script and TS resolver share ONE ordered source list.
• toolkit CI dual-publishes CLI releases + nightlies to BOTH getsentry/cli and toolkit for the compat window (cross-repo token contents:write; retain oras push ghcr.io/getsentry/cli).
• Preserve delta-patch chains (content-addressed sha256-<binary> / from-version); verify chain-depth + cleanup keep-count parity on both GHCR packages.
• e2e tests stubbing both hosts, asserting fallback on 404.
• Sunset after ~2 stable releases + ~90 days of nightlies.

See §5.1.

[BYK]

Master tracking issue: #1248