Fallback for version resolution over unauthenticated git for feature installation.

[Kaniska (v-Kaniska244)]

Description

Closes #1726.

Several Features resolve partial or symbolic versions using unauthenticated
git ls-remote requests. When those requests fail because of network issues,
rate limiting, or GitHub availability, Feature installation currently fails
without another resolution path.

This PR introduces shared, resilient version-resolution behavior across 14
Features.

Changes

• Adds a shared version resolver supporting this resolution order:

  1. Accept fully qualified versions without network validation.
  2. Resolve partial or symbolic versions from Git tags.
  3. Fall back to the GitHub REST tags API for GitHub repositories.
  4. Support caller-provided alternate sources, such as the official Go
     release index.
  5. Use a compatible, installer-owned known-good version when dynamic
     resolution remains unavailable.
  6. Return an actionable error when no compatible version can be resolved.

• Normalizes tag prefixes and supports:

  • latest, current, stable, and lts
  • preview and prerelease
  • optional patch versions
  • custom tag prefixes and separators
  • prerelease suffix patterns

• Keeps fully qualified user versions independent of remote availability.

• Emits warnings identifying failed and fallback resolution sources.

• Defines each known-good version as a visible top-level
  *_LAST_KNOWN_VERSION variable in its owning installer. The shared resolver
  contains no repository-to-version catalog.

• Adds a synchronization script for distributing the canonical resolver into
  each Feature package and checking for drift.

Affected Features

• Copilot CLI
• Docker-in-Docker
• Docker-outside-of-Docker
• Git LFS
• GitHub CLI
• Go
• Kubectl, Helm, and Minikube
• Nix
• Node.js / NVM
• PHP / Xdebug
• PowerShell stable and preview
• Python / OpenSSL / Cosign
• Rust
• Terraform / TFLint / Terragrunt / tfsec / terraform-docs

Each affected Feature receives a patch version bump.

Tests

Adds a deterministic, network-independent test matrix covering every affected
Feature and tool.

The suite verifies:

• exact versions do not perform remote resolution
• Git tag resolution
• automatic GitHub REST fallback
• caller-provided alternate sources
• known-good fallback when all dynamic sources fail
• rejection of incompatible or malformed fallback versions
• actionable failure messages
• installer declaration and use of every *_LAST_KNOWN_VERSION
• coverage of all 14 affected Features
• synchronization of all Feature-local resolver copies

The test matrix derives known-good values directly from each installer rather
than duplicating version pins in test data.

A focused GitHub Actions workflow runs synchronization checks, fallback tests,
and ShellCheck whenever relevant files change.

Validation

• 117 version-resolution assertions pass
• All affected installer scripts pass bash -n
• Resolver copies pass synchronization checks
• Resolver and test scripts pass ShellCheck
• git diff --check passes
• Copilot CLI prerelease scenario passes
• Kubectl/Helm/Minikube exact-version scenario passes with:
  • kubectl v1.33.0
  • Helm v3.17.3
  • Minikube v1.31.1

Compatibility

No Feature options or existing exact-version behavior are removed. The new
fallback paths apply only when dynamic version discovery is required and the
preferred source is unavailable.