feat(ci): install pinned fd and rg in setup-kipp

[pleb]

What

setup-kipp gains an "Install search tools" step. It reads the fd and rg pins the Kipp package declares under kipp.tools, downloads the asset for the runner's platform, verifies its SHA-256 before extracting, and installs the binary into the Pi agent directory's bin. Each binary is smoke-tested with --version.

Why

Pi's find and grep tools need fd and rg. The hosted Ubuntu runner image ships neither, and under PI_OFFLINE=1 Pi cannot download them, so those tools fail in CI and a session falls back to shell searches. One such fallback (an unpruned find over installed node_modules) stalled a dependency remediation run.

Pi 0.84.2's getToolPath checks $PI_CODING_AGENT_DIR/bin before PATH, so installing there needs no change to the session's environment. Declaring the pins in the Kipp package, beside kipp.supportedPiVersion, makes a tool upgrade a Kipp release rather than a shared-config change.

Behaviour

• Validation runs on every runner, before a platform is chosen. For each tool: an exact version, a .tar.gz release download from sharkdp/fd or BurntSushi/ripgrep whose tag is the version (or v plus the version), and a 64-character SHA-256. A malformed block fails the step. Validation errors name the field rather than echo a malformed value; a value is printed only after it has passed validation (the release tag, the URL, the checksums).
• Platforms: Linux/X64 and Linux/ARM64. Any other runner skips with a notice.
• Earlier releases: a package that declares no kipp.tools skips with a notice.
• Missing asset: a tool with no pin for the runner's platform is skipped with its own notice.
• Download hardening: curl runs HTTPS-only (redirects included), with 3 retries and a 120-second limit. Extraction uses --no-same-owner, and the binary is installed 0755.
• Fatal: a failed download, a checksum mismatch, a failed extraction, an archive without exactly one matching binary, or a failed smoke test.
• Bash 3.2: the step avoids associative arrays and mapfile, so a macOS runner reaches the skip notice.

Testing

• shellcheck and zizmor --offline are clean.
• The step's run body, extracted from action.yml and run with RUNNER_OS and RUNNER_ARCH set and fake manifests pinned to the real fd v10.5.0 and ripgrep 15.2.0 assets, under both bash 3.2.57 and bash 5.2: installs on Linux X64 and ARM64, checksum mismatch, download and extraction failures, malformed blocks, and the skip paths.
• End to end in a container with Pi 0.84.2 and PI_OFFLINE=1: after the step, getToolPath and ensureTool resolve fd and rg from the agent directory.

[github-actions]

🛡️ SHA Pinned Actions Report

✅ All 31 file(s) passed — actions are allowed and pinned as required.

[mderriey]

Overall looks good, but I couldn't find a manifest in Kipp's main branch that declares the tools and the associated versions, which made it a bit hard to validate.