fix(ci): correct the self-heal companion release-asset pattern

[joshua-temple]

Problem

The Pin Reconcile companion (.github/workflows/pin-reconcile.yaml) installed the pinned cascade CLI with gh release download -p 'cascade_linux_amd64.tar.gz'. goreleaser emits VERSIONED asset names (the real v0.9.0 asset is cascade_0.9.0_linux_amd64.tar.gz), so the unversioned pattern matched nothing, the download produced no file, and tar -xzf "$tmp"/*.tar.gz failed the step. The self-heal push could never run.

Fix

Change the asset pattern to cascade_*_linux_amd64.tar.gz, matching the proven .github/actions/setup-cli composite action exactly. The tar-extract glob, install path, and cascade version lines already matched setup-cli.

Audit

A full step-by-step comparison of the companion against setup-cli/action.yaml and the emitted generator logic in internal/generate/reconcile_companion.go found no other runtime defect:

• Binary install: only the asset pattern was wrong; tag resolution (gh release list -L 1), extraction, install, and version print are consistent with setup-cli.
• Changed-files on the workflow_run side: the checkout uses fetch-depth: 0, which fetches all branches (+refs/heads/*:refs/remotes/origin/*) plus tags, so the base-branch tip resolved as base_sha is present locally and git diff "$BASE_SHA" "$HEAD_SHA" resolves. Correct as-is.
• Reconcile invocation, staging pathspec allowlist, DCO-only bot commit, fork guard, push-only-if-diff, and the non-fast-forward abort are all correct.

Verification

• actionlint (with shellcheck) on pin-reconcile.yaml and pr.yaml: zero findings.
• go build ./...: clean (no Go change).
• Follow-up: an intentional governed-pin bump on a PR will exercise the companion end to end.