[scanner] ci-runners: pinned gh 2.103.2 vanished from the apt repo again; cli-pin-bump does not cover GITHUB_CLI_VERSION #14611

Problem

src/deploy/ci-runners/Dockerfile pins ARG GITHUB_CLI_VERSION=2.103.2 and installs gh=${GITHUB_CLI_VERSION} from https://cli.github.com/packages. The "CI Runner Image" workflow (job "Build (PR gate, no push)") now fails with E: Version '2.103.2' for 'gh' was not found on every PR touching the runner image, currently #14399 (run https://github.com/hivecommons/hive/actions/runs/40542991463).

Evidence: curl -s https://cli.github.com/packages/dists/stable/main/binary-amd64/Packages | grep ^Version returns only 2.103.3.

Second occurrence: #14341 bumped the same pin 2.102.0 -> 2.103.2 because apt dropped 2.102.0. v6 still pins 2.102.1 (also gone).

Root cause

The apt repo serves only the latest gh version, so any exact pin rots within days. The daily gate (.github/workflows/cli-pin-bump.yml + src/scripts/cli-pin-bump.sh) only rewrites GH_VERSION/GH_SHA256_* in src/Dockerfile and src/Dockerfile.contributor; it never touches GITHUB_CLI_VERSION in the runner Dockerfile.

Decision taken by hive: bump the pin to 2.103.3 and extend cli-pin-bump.sh (apply gh) to keep GITHUB_CLI_VERSION in src/deploy/ci-runners/Dockerfile current.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88