[product-manager-impersonator] Add an atomic quick-setup preflight

## Feature Idea

**Summary:** Add a `--preflight` mode to quick setup that validates every requested workflow download before creating a branch or writing workflow files, then stages downloads atomically so a failed URL cannot leave a partial setup.

## Why a Customer Would Want This

Maintainers commonly run the one-command installer in a repository they are configuring for the first time. A typo in `--workflows`, a missing release file, or a transient raw-content failure can currently leave setup halfway complete: the script creates or checks out the setup branch before downloading, and downloads are written directly into `.github/workflows`. Customers then have to identify and clean up partial changes before retrying, which is especially risky when setup is run by automation.

## Rough Implementation Sketch
- Add `--preflight` and document it alongside the existing `--dry-run` option.
- Build the complete list of workflow and maintenance URLs, then run `curl --fail --head` (or an equivalent lightweight validation) for all of them before branch creation.
- Download into a temporary staging directory under the repository, and move the validated files into `.github/workflows` only after every download succeeds; clean the staging directory on exit.
- Keep the current default behavior unchanged, while making `--preflight` useful for CI and cautious first runs.

## Why It Won't Be That Hard

The behavior is isolated to the 229-line `scripts/quick-setup.sh` script. It already centralizes the workflow list, source/destination calculation, `--dry-run` handling, and the `created_files` array, so this needs a small flag, a validation loop, and a staging step rather than changes to the workflow compiler.

## Evidence
- [`scripts/quick-setup.sh:167-177`](https://github.com/elastic/ai-github-actions/blob/main/scripts/quick-setup.sh#L167-L177) creates or checks out the setup branch before downloads begin.
- [`scripts/quick-setup.sh:188-207`](https://github.com/elastic/ai-github-actions/blob/main/scripts/quick-setup.sh#L188-L207) downloads each URL directly to its final destination; with `set -e`, a later failed download can leave earlier files in place.
- [`scripts/quick-setup.sh:27`](https://github.com/elastic/ai-github-actions/blob/main/scripts/quick-setup.sh#L27) shows that the existing `--dry-run` only prints actions and does not validate remote URLs.
- [`gh-agent-workflows/README.md:44-65`](https://github.com/elastic/ai-github-actions/blob/main/gh-agent-workflows/README.md#L44-L65) presents quick setup as the primary installation path and supports custom workflow lists.

## Suggested Actions

- [ ] Add `--preflight` parsing, URL validation, and staged downloads to `scripts/quick-setup.sh`.
- [ ] Add failure-path coverage for an invalid workflow URL and verify no branch/files are created.
- [ ] Document the mode in the root and workflow README quick-setup sections.

> [!WARNING]
>
> Firewall blocked 1 domain
>
> The following domain was blocked by the firewall during workflow execution:
>
> - `awmgmcpg`
>> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "awmgmcpg"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Product Manager Impersonator](https://github.com/elastic/ai-github-actions/actions/runs/30086909065)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

Read scripts/quick-setup.sh, especially the branch setup at lines 167-177, download loop at 188-207, and existing --dry-run handling at line 27. Trace the workflow URL and destination lists first, then add failure-path coverage and update the root and gh-agent-workflows/README.md quick-setup sections; done means preflight validates all URLs and failed downloads leave no branch or workflow files.

Written by the indexing model from the issue text.