Document every outbound endpoint used by dw upgrade

[rmcdaniel]

Problem

The CLI distribution guide presents its telemetry section as a behavior contract for every network request the CLI can make. It currently says dw upgrade contacts GitHub's release API, but the shipped command first reads the qualified CLI version from the public Durable Workflow compatibility authority and then downloads the selected binary and SHA256SUMS from GitHub release URLs.

Operators can use this contract for egress allowlists and compliance review. Omitting the authority request and describing release downloads as an API request makes that contract incomplete even though the traffic is explicit and user-invoked.

Acceptance criteria

• Public CLI distribution/security documentation names the supported-release authority lookup separately from release-asset and checksum downloads.
• The documented endpoint families and purposes match the requests made by an ordinary unpinned dw upgrade, including dry-run behavior.
• The documentation continues to make clear that all update traffic is explicit and that no background update or telemetry request is introduced.
• Auditable behavior-level coverage records the upgrade request sequence so a future destination change cannot silently leave the security contract stale.

Delete when

Delete when the public network behavior contract accurately covers every endpoint family contacted by dw upgrade, and validation evidence covers authority resolution plus artifact/checksum retrieval without relying on brittle prose or Markdown structure.

[rmcdaniel]

Current status: Approved and queued

This issue is approved and queued for implementation.