CI: validate AGENTCTL_INSTALL (allowlist go-build | release)

[leo-aa88]

Problem

Workflows treat any value other than go-build as release install mode:

if: env.AGENTCTL_INSTALL != 'go-build'

A typo like AGENTCTL_INSTALL=relase silently selects the release tarball path instead of go-build, which is confusing to debug.

Proposal

At the start of install steps (or once per job), validate with bash:

case "${AGENTCTL_INSTALL:-go-build}" in
  go-build|release) ;;
  *) echo "AGENTCTL_INSTALL must be 'go-build' or 'release', got '${AGENTCTL_INSTALL}'" >&2; exit 1 ;;
esac

Then use == 'release' for the release branch instead of != 'go-build' (or keep != go-build but only after the case).

Apply consistently in:

• .github/workflows/agentctl-pr-review.yml
• .github/workflows/agentctl-pr-review-publish.yml

Acceptance criteria

• Invalid values fail fast with a clear message.
• Document the two allowed values in docs/GITHUB_ACTIONS.md (install table / env table).