fix(extensions,presets,workflows): resolve private GHES release assets via /api/v3 (#3157)

* feat(auth): add github_provider_hosts() to enumerate GHES hosts from auth.json

Assisted-by: Claude Code (model: claude-sonnet-4-6, autonomous)

* fix(extensions): resolve GHES release assets via /api/v3

Generalizes resolve_github_release_asset_api_url to GitHub Enterprise
Server hosts (gated by auth.json github hosts), fixing private GHES
extension/preset downloads. github/spec-kit#3147

Assisted-by: Claude Code (model: claude-sonnet-4-6, autonomous)

* fix(extensions,presets): pass auth.json github hosts into release resolver

Assisted-by: Claude Code (model: claude-sonnet-4-6, autonomous)

* docs(auth): document GHES private catalog + release-asset auth

Assisted-by: Claude Code (model: claude-sonnet-4-6, autonomous)

* fix(presets,workflows): pass auth.json github hosts into remaining release resolvers

Wires preset add --from and workflow add through github_provider_hosts()
so private GHES release assets resolve via /api/v3 there too. github/spec-kit#3147

Assisted-by: Claude Code (model: claude-sonnet-4-6, autonomous)

* test(presets): use module-level io.BytesIO in GHES preset test

Addresses Copilot review on PR #3157: drop unnecessary __import__("io")
in test_preset_add_from_ghes_release_url_resolves_via_api_v3 since io is
already imported at module level.

* fix(github-http): pass through GHES asset API URLs by path shape

Addresses Copilot review on PR #3157. A direct GHES /api/v3 release asset
URL was only returned as already-resolved when its host was in the
allowlist; otherwise the resolver returned None and the caller downloaded
the same URL without 'Accept: application/octet-stream', fetching JSON
metadata instead of the binary.

Gate the passthrough on path shape alone, mirroring the github.com case.
This is safe: passthrough returns the input URL unchanged and the caller
fetches it either way, so no new request to an arbitrary host is induced;
the token stays independently gated by auth.json in open_url. The
allowlist remains the anti-SSRF gate on the tag-lookup resolving path.

Add test_passthrough_for_unlisted_ghes_api_asset_url.

tests/test_github_http.py

@@ -188,3 +188,117 @@ class TestResolveGitHubReleaseAssetApiUrl:
         )
         assert len(captured_urls) == 1
         assert "releases/tags/v1%23beta" in captured_urls[0]
+
+    # --- GHES (GitHub Enterprise Server) ---
+
+    def test_resolves_ghes_browser_url_to_api_url(self):
+        """A GHES browser release URL resolves to the /api/v3 asset URL."""
+        release_json = {
+            "assets": [
+                {"name": "ext.zip",
+                 "url": "https://ghes.example/api/v3/repos/o/r/releases/assets/7"}
+            ]
+        }
+        result = resolve_github_release_asset_api_url(
+            "https://ghes.example/o/r/releases/download/v1/ext.zip",
+            self._make_open_url_fn(release_json),
+            github_hosts=("ghes.example",),
+        )
+        assert result == "https://ghes.example/api/v3/repos/o/r/releases/assets/7"
+
+    def test_passthrough_for_existing_ghes_api_asset_url(self):
+        """An already-resolved GHES /api/v3 asset URL is returned as-is."""
+        url = "https://ghes.example/api/v3/repos/o/r/releases/assets/7"
+        result = resolve_github_release_asset_api_url(
+            url, lambda *a, **kw: None, github_hosts=("ghes.example",)
+        )
+        assert result == url
+
+    def test_returns_none_for_ghes_host_not_in_allowlist(self):
+        """Unlisted hosts get no GHES treatment and trigger no API call (anti-SSRF)."""
+        called = []
+
+        @contextmanager
+        def recording_open(url, timeout=None, extra_headers=None):
+            called.append(url)
+            resp = MagicMock()
+            resp.read.return_value = b"{}"
+            yield resp
+
+        result = resolve_github_release_asset_api_url(
+            "https://ghes.example/o/r/releases/download/v1/ext.zip",
+            recording_open,
+            github_hosts=("other.example",),
+        )
+        assert result is None
+        assert called == []
+
+    def test_passthrough_for_unlisted_ghes_api_asset_url(self):
+        """A direct GHES /api/v3 asset URL passes through even when the host is
+        not allowlisted: passthrough issues no API request, and the download
+        helper gates the token independently, so octet-stream resolution must
+        not be withheld."""
+        called = []
+
+        @contextmanager
+        def recording_open(url, timeout=None, extra_headers=None):
+            called.append(url)
+            resp = MagicMock()
+            resp.read.return_value = b"{}"
+            yield resp
+
+        url = "https://ghes.example/api/v3/repos/o/r/releases/assets/7"
+        result = resolve_github_release_asset_api_url(
+            url, recording_open, github_hosts=("other.example",)
+        )
+        assert result == url
+        assert called == []
+
+    def test_ghes_api_base_preserves_scheme_and_port(self):
+        """The GHES API base mirrors the URL scheme and keeps a non-standard port."""
+        captured = []
+
+        @contextmanager
+        def capturing_open(url, timeout=None, extra_headers=None):
+            captured.append(url)
+            resp = MagicMock()
+            resp.read.return_value = json.dumps({"assets": []}).encode()
+            yield resp
+
+        resolve_github_release_asset_api_url(
+            "http://localhost:8000/o/r/releases/download/v1/ext.zip",
+            capturing_open,
+            github_hosts=("localhost",),
+        )
+        assert captured == ["http://localhost:8000/api/v3/repos/o/r/releases/tags/v1"]
+
+    def test_ghes_wildcard_does_not_match_bare_host(self):
+        """A '*.suffix' pattern does not match the bare host (must list it explicitly)."""
+        result = resolve_github_release_asset_api_url(
+            "https://ghes.example/o/r/releases/download/v1/ext.zip",
+            lambda *a, **kw: None,
+            github_hosts=("*.ghes.example",),
+        )
+        assert result is None
+
+    def test_public_github_url_unaffected_by_github_hosts(self):
+        """Public github.com still resolves via api.github.com even with github_hosts set."""
+        captured = []
+
+        @contextmanager
+        def capturing_open(url, timeout=None, extra_headers=None):
+            captured.append(url)
+            resp = MagicMock()
+            resp.read.return_value = json.dumps({
+                "assets": [{"name": "pack.zip",
+                            "url": "https://api.github.com/repos/org/repo/releases/assets/99"}]
+            }).encode()
+            yield resp
+
+        result = resolve_github_release_asset_api_url(
+            "https://github.com/org/repo/releases/download/v1.0/pack.zip",
+            capturing_open,
+            github_hosts=("ghes.example",),
+        )
+        assert result == "https://api.github.com/repos/org/repo/releases/assets/99"
+        assert captured == ["https://api.github.com/repos/org/repo/releases/tags/v1.0"]