fix(cli): honor restore installer channel selection

[peters]

Summary

• add installer-only restore --channel support and thread the selected channel through the restore path
• generate installer filenames and embedded installer.yml metadata from the selected channel instead of the app default channel
• update remote published-installer lookup to use the requested channel key directly and document the new restore -i --channel flow

Root Cause

Installer-only restore and remote published-installer lookup were coupled to app.channels.first() or the manifest default channel. That meant rebuilding installers after promoting an existing release required manifest rewriting or other downstream workarounds.

Impact

• surge restore -i --channel production now resolves releases on production
• generated installer names and uploaded installer keys use the requested channel
• embedded installer.yml persists the requested runtime channel metadata
• remote published-installer lookup no longer blocks on a default-channel mismatch

Validation

• cargo check -p surge-cli
• ./scripts/check-maintainability.sh
• cargo test -p surge-cli cli::tests::restore_
• cargo test -p surge-cli execute_installers_only_
• cargo test -p surge-cli plan_remote_published_installer
• cargo clippy -p surge-cli --all-targets --all-features -- -D warnings -W clippy::pedantic
• ./scripts/sync-surge-core-vendor.sh --check
• ./scripts/check-version-sync.sh
• cargo fmt --all -- --check
• RUSTFLAGS="-D warnings" cargo test --workspace
• cargo clippy --all-targets --all-features -- -D warnings
• cargo clippy --workspace --lib --bins --examples -- -D warnings -D clippy::unwrap_used -D clippy::expect_used
• cargo clippy --workspace --all-targets --all-features -- -D warnings -W clippy::pedantic
• dotnet format dotnet/Surge.slnx --verify-no-changes
• dotnet test dotnet/Surge.slnx --configuration Release

Migration Notes

• none