ci: Replace curl-pipe-bash with action-setup-cli for Sentry CLI setup

[oioki]

Summary

• The "Install sentry-cli" step used curl -sL https://sentry.io/get-cli/ | bash, piping a remote install script directly into a shell.
• Replaced it with getsentry/action-setup-cli, which downloads the sentry-cli release asset for the runner's OS/arch and verifies its sha256 against the digest GitHub recorded for that asset via the Releases API, before adding it to PATH. Uses gh only, no curl.

Test plan

• Validated image.yml parses correctly
• Verify the build-image-production job still installs sentry-cli and uploads debug symbols correctly on this PR

Fixes VULN-2227

🤖 Generated with Claude Code

[linear-code]

VULN-2227

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit e89358b. Configure here.}