Support independently pinned threat-detect artifacts

## Problem

gh-aw v0.87.9 defaults to the external threat detector. The detector version is pinned, but `install_threat_detect_binary.sh` derives both the executable URL and `checksums.txt` URL from the same GitHub release. This detects corruption but does not provide an independent trust root or support organizations that require third-party artifacts to come through an approved artifact proxy.

Current source:

- The external detector is enabled by default, with `gh-aw-detection: false` selecting the legacy inline path: [`pkg/constants/feature_constants.go`](https://github.com/github/gh-aw/blob/a5297995b4bd76a2afcc39f10f2517a65aff172c/pkg/constants/feature_constants.go#L89-L98)
- The detector version is pinned by `DefaultThreatDetectVersion`: [`pkg/constants/version_constants.go`](https://github.com/github/gh-aw/blob/a5297995b4bd76a2afcc39f10f2517a65aff172c/pkg/constants/version_constants.go#L210-L214)
- The installer derives `checksums.txt` and the architecture-specific binary from the same release base URL, then verifies the binary against that downloaded checksum file: [`actions/setup/sh/install_threat_detect_binary.sh`](https://github.com/github/gh-aw/blob/a5297995b4bd76a2afcc39f10f2517a65aff172c/actions/setup/sh/install_threat_detect_binary.sh#L107-L175)
- Generated workflows invoke the installer directly with the pinned version: [`pkg/workflow/threat_detection_steps.go`](https://github.com/github/gh-aw/blob/a5297995b4bd76a2afcc39f10f2517a65aff172c/pkg/workflow/threat_detection_steps.go#L568-L598)

## Requested support

Please consider supporting one or more of:

- A compiler-embedded SHA-256 digest for each supported binary.
- Configurable artifact and checksum URLs.
- A supported hook allowing consumers to install and verify `threat-detect` before execution.
- A way to disable installation while retaining external detection with a preinstalled binary.

The mechanism should fail closed, preserve architecture selection, and avoid trusting a checksum fetched from the same mutable source as the binary.

For now, affected consumers can select the legacy inline path with:

```yaml
features:
gh-aw-detection: false
```

## References

- External detector migration: [PR #40166](https://github.com/github/gh-aw/pull/40166)
- Default enablement: [PR #54111](https://github.com/github/gh-aw/pull/54111)
- v0.87.9 release: [github/gh-aw v0.87.9](https://github.com/github/gh-aw/releases/tag/v0.87.9)