fix: pin the bws version instead of resolving it

ensure_bws resolved the version from the GitHub releases list API. That
worked on the dev box and failed in a bare container with "could not
resolve the current bws version" — because the dev shell had `gh`
authenticated and the container did not. Unauthenticated, that endpoint
returns an empty array for this repo.

The obvious fallback does not work either: sdk-sm is a monorepo with
per-component tags, so /releases/latest redirects to python-v2.1.0 rather
than any bws release.

Release-download URLs need no auth, so BWS_PIN=2.1.0 and the published
sha256 makes bumping it safe. Same pattern as FZF_PIN.

dot_local/bin/executable_dotup

@@ -379,6 +379,8 @@ norm() { printf '%s\n' "$*" | tr ' ' '\n' | grep . | tr '\n' ' ' | sed 's/ $//';
 # Used wherever a URL that may carry a credential is about to be printed.
 redact_url() { printf '%s\n' "$1" | sed 's#://[^/@]*@#://<redacted>@#'; }
 
+BWS_PIN=2.1.0
+
 # The Bitwarden Secrets Manager CLI, installed by the PRIVATE tier only.
 #
 # It cannot be a manifest row. `selected_packages` drops every row flagged
@@ -403,11 +405,20 @@ ensure_bws() {
 		*) err "no bws build for $(uname -m)"; return 1 ;;
 		esac ;;
 	esac
-	# sdk-sm is a monorepo with per-component tags, so the `latest` release is
+	# Pinned, the same way fzf is, and for a better reason than caution.
-	# usually a python SDK rather than bws. Filter by tag prefix.
+	#
-	v=$(curl -fsSL 'https://api.github.com/repos/bitwarden/sdk-sm/releases?per_page=40' 2>/dev/null \
+	# There is no way to resolve "the current bws" without authenticating.
-		| sed -n 's/.*"tag_name": *"bws-v\([0-9.]*\)".*/\1/p' | head -1)
+	# sdk-sm is a monorepo with per-component tags, so /releases/latest
-	[ -n "$v" ] || { err "could not resolve the current bws version"; return 1; }
+	# redirects to whatever shipped last — measured 2026-08-17, that is
+	# `python-v2.1.0`, not bws. And the unauthenticated releases LIST endpoint
+	# returns an empty array for this repo: an earlier version of this function
+	# resolved the version through it and worked on the dev box only because
+	# `gh` had authenticated that shell. In a bare container it returned nothing
+	# and the install failed with "could not resolve the current bws version".
+	#
+	# Release-download URLs need no auth at all, so pin and move on. Bump BWS_PIN
+	# deliberately; the checksum below is what makes that safe.
+	v=$BWS_PIN
 	b=https://github.com/bitwarden/sdk-sm/releases/download/bws-v$v
 	say "  fetching bws $v"
 	curl -fsSL "$b/bws-$t-$v.zip" -o /tmp/bws.zip 2>/dev/null \