GitHub release Link reconstruction

Trap: fetching GitHub’s Link URL verbatim looks correct because it is server-provided, but canonical links use /repositories/<id>/releases and still form an untrusted redirect surface. Fix: accept only HTTPS api.github.com release paths, extract a positive decimal page, rebuild from the selected source’s trusted release-list URL, reject malformed/off-origin/cyclic links, traverse every page, and choose the global highest stable SemVer.