ci: Replace curl-pipe-bash with action-setup-cli for Sentry CLI setup

[oioki]

Summary

• The "Setup Sentry CLI" step used curl -sL https://sentry.io/get-cli/ | SENTRY_CLI_VERSION="3.4.3" bash, piping a remote install script directly into a shell.
• Replaced it with getsentry/action-setup-cli, which downloads the sentry-cli release asset for the runner's OS/arch and verifies its sha256 against the digest GitHub recorded for that asset via the Releases API, before adding it to PATH. Uses gh only, no curl.
• Same pinned version (3.4.3) preserved via the action's version input.

This is one of two live examples of this new action in use — the other is sentry-fastlane-plugin#529, which is green on all checks.

Test plan

• Validated action.yaml parses correctly
• Verify the end-to-end test job installs sentry-cli 3.4.3 correctly on this PR

Fixes VULN-2365

🤖 Generated with Claude Code

[linear-code]

VULN-2365