ci: pre-flight validation that pinned agent versions are downloadable

[AntoineToussaint]

Problem

Pinned agent versions can have a git tag but no downloadable artifact (no GitHub release asset / OCI manifest). Today this surfaces only as an opaque mid-run failure deep inside a phase:

flow.InitManagers: ... services.LoadAgent: ... cannot download agent
(tried Nix + OCI + GitHub): agent: binary not found: unexpected status code 404

There is no early, legible signal that a pin is simply unpublished. In module-saas-starter#3, all six pinned agents (go-grpc 0.1.12, nextjs 0.0.114, redis 0.0.74, postgres 0.0.103, s3 0.0.16, vault 0.0.15) are tagged but have no release assets, so every service 404s.

Ask

Add a pre-flight "validate agent versions" step to codefly ci run (before the phase loop) that, for each affected service's pinned agent, resolves the artifact against the configured sources (HEAD the GitHub release asset and/or the OCI manifest per AGENT_REGISTRY) and fails fast with a single, clear report listing every pin that has no downloadable artifact, e.g.:

agent codefly.dev/redis:0.0.74 is not published (no CI-downloadable artifact)
  - GitHub release asset service-redis_0.0.74_linux_amd64.tar.gz: 404
  - OCI ghcr.io/codefly-dev/agents/codefly.dev/redis:0.0.74: not configured
  -> tag + release the agent, or set AGENT_REGISTRY

This turns a confusing mid-run 404 into an actionable "these pins aren't published" message.

Tracking consumer: codefly-dev/module-saas-starter#3.