refactor(install): drop the gh presence check, hosted runners always have it

GitHub-hosted runners ship gh; only a self-hosted runner can lack it, and
there the attestation step fails anyway. The failure message now carries
that hint instead of a separate pre-check.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018xYa7m3qup5wyN5MaXFgf6

Author: shenxianpeng

README.md

@@ -88,7 +88,7 @@ The action is a composite step and uses what the runner already has:
   installs goes under `$RUNNER_TEMP`, never into your checkout.
 - **`gh` CLI** — used to verify the build-provenance attestation of the
   `commit-check` wheel before installing it. Present on GitHub-hosted images;
-  install it on self-hosted runners or the step fails with `gh CLI not found`.
+  install it on self-hosted runners or the attestation step fails.
   Only the `commit-check` wheel is attested; PyGithub and the transitive
   dependencies are pinned by `requirements.txt` but not verified.
 - **Network access to PyPI and `api.github.com`** — the pinned wheels are

action.yml

@@ -83,13 +83,9 @@ runs:
 
         # Verify the commit-check wheel's build provenance (PyGithub and the
         # transitive wheels are pinned but not attested; see README "Runner requirements").
-        if ! command -v gh >/dev/null 2>&1; then
-          echo "::error::gh CLI not found; it is required to verify the commit-check wheel attestation. Install it on this runner (preinstalled on GitHub-hosted runners)."
-          exit 1
-        fi
         WHEEL=$(ls "$WORK"/wheels/commit_check-*.whl)   # exactly one: pip download of a == pin
         if ! gh attestation verify "$WHEEL" -R commit-check/commit-check; then
-          echo "::error::Attestation verification failed for $(basename "$WHEEL"). Aborting installation."
+          echo "::error::Attestation verification failed for $(basename "$WHEEL") (self-hosted runners need the gh CLI). Aborting installation."
           exit 1
         fi