ci(workflows): validate AGENTCTL_INSTALL allowlist

[leo-aa88]

Summary

• Add a Validate AGENTCTL_INSTALL step at the start of install-related jobs in agentctl-pr-review.yml and agentctl-pr-review-publish.yml that fails fast with a clear message when the value is not go-build or release.
• Switch the release tarball install step from != 'go-build' to == 'release' so typos no longer silently select release mode.
• Document the allowlist in docs/GITHUB_ACTIONS.md (install table and env table).

Fixes #97

Test plan

• Confirm default AGENTCTL_INSTALL: go-build workflows still pass on PR (existing monorepo CI).
• Optionally set AGENTCTL_INSTALL: relase in a fork/workflow_dispatch test and verify the validate step fails with the expected message.
• Downstream copy: set AGENTCTL_INSTALL: release + pinned AGENTCTL_VERSION and confirm release tarball install runs.

Made with Cursor

[github-actions]

ReviewGate [WARN] WARN

Stats

• Files changed: 3
• Raw LOC changed: 26
• LOC after §10.4 exclusions (human_loc_changed): 26
• PR author class: human (human collaborator account) — login leo-aa88 (§10.4.2).

Warnings (2)

• medium many_risky_files -- This PR touches 2 risky files, at or above the warning threshold of 2 (risky_files_changed).
• medium many_config_files -- This PR touches 2 config files, at or above the warning threshold of 1 (config_files_changed).

Suggested labels: reviewability-warn, risky-change, config-change

File categories: 3 files (2 risky)

[github-actions]

Automated review

Summary

Enhancements made to validate AGENTCTL_INSTALL values are generally positive.

Findings

• No issues found.