A private repo release asset cannot be an unauthenticated install URL

An installer that runs on a new user machine fetches its payload before that user holds any credential, so every URL baked into it must be reachable anonymously. A release asset of a PRIVATE repository is not: an unauthenticated request returns 404, the same as a nonexistent repo, so the failure looks like a wrong URL rather than a permissions problem. This bites hardest when CI publishes the artifact and prints the release URL ready to paste -- the operator pastes exactly what the tooling handed them and gets a 404 with no hint that visibility is the cause. Verify with an unauthenticated curl of the repo API before documenting any release URL as an install source. The workable options are hosting the artifact on the deployment itself, an internal artifact store, or an object store; the self-hosting path that reads like an air-gap edge case is actually the normal one whenever the source repo is private.