Support independently pinned threat-detect artifacts

[loganrosen]

Problem

gh-aw v0.87.9 defaults to the external threat detector. The detector version is pinned, but install_threat_detect_binary.sh derives both the executable URL and checksums.txt URL from the same GitHub release. This detects corruption but does not provide an independent trust root or support organizations that require third-party artifacts to come through an approved artifact proxy.

Current source:

• The external detector is enabled by default, with gh-aw-detection: false selecting the legacy inline path: pkg/constants/feature_constants.go
• The detector version is pinned by DefaultThreatDetectVersion: pkg/constants/version_constants.go
• The installer derives checksums.txt and the architecture-specific binary from the same release base URL, then verifies the binary against that downloaded checksum file: actions/setup/sh/install_threat_detect_binary.sh
• Generated workflows invoke the installer directly with the pinned version: pkg/workflow/threat_detection_steps.go

Requested support

Please consider supporting one or more of:

• A compiler-embedded SHA-256 digest for each supported binary.
• Configurable artifact and checksum URLs.
• A supported hook allowing consumers to install and verify threat-detect before execution.
• A way to disable installation while retaining external detection with a preinstalled binary.

The mechanism should fail closed, preserve architecture selection, and avoid trusting a checksum fetched from the same mutable source as the binary.

For now, affected consumers can select the legacy inline path with:

features:
  gh-aw-detection: false

References

• External detector migration: PR #40166
• Default enablement: PR #54111
• v0.87.9 release: github/gh-aw v0.87.9