ensure_bws resolved the version from the GitHub releases list API. That
worked on the dev box and failed in a bare container with "could not
resolve the current bws version" — because the dev shell had `gh`
authenticated and the container did not. Unauthenticated, that endpoint
returns an empty array for this repo.
The obvious fallback does not work either: sdk-sm is a monorepo with
per-component tags, so /releases/latest redirects to python-v2.1.0 rather
than any bws release.
Release-download URLs need no auth, so BWS_PIN=2.1.0 and the published
sha256 makes bumping it safe. Same pattern as FZF_PIN.
bcherb2
68e16ad1ff