ci: replace aqua tool downloads with dedicated GitHub Actions (#2712)
* ci: replace aqua tool downloads with dedicated GitHub Actions
Replace fragile aqua downloads from GitHub Releases with dedicated
actions that are more reliable:
- gotestsum: go install via Go module proxy (avoids GitHub Releases entirely)
- cargo-deny: taiki-e/install-action (prebuilt with checksum verification)
- cargo-nextest: taiki-e/install-action (prebuilt with checksum verification)
- coglet wheel build: PyO3/maturin-action (bundles maturin + zig)
This eliminates transient 502 errors from GitHub Releases during CI,
removes mise as a dependency from build-rust, test-rust, test-go, and
lint-rust-deny jobs, and makes the coglet wheel build consistent with
the release pipeline.
Tools remain available via aqua in mise.toml for local development.
* docs: document CI tool dependency management
Add sections to both AGENTS.md and CONTRIBUTING.md explaining the
dual-maintenance requirement for tool versions between mise.toml
(local dev) and ci.yaml (CI), including the table of CI-specific
installation methods and why each avoids aqua/GitHub Releases.