feat(tenancy): harden shared cloud runtime boundaries

web/src/app/home/add-extension/page.tsx

@@ -636,7 +636,8 @@ function AddExtensionContent() {
     const pluginDisplayName = `${githubOwner}/${githubRepo}`;
     httpClient
       .installPluginFromGithub(
-        selectedAsset.download_url,
+        selectedAsset.id,
+        selectedRelease.id,
         githubOwner,
         githubRepo,
         selectedRelease.tag_name,

web/src/app/infra/http/BackendClient.ts

@@ -741,13 +741,15 @@ export class BackendClient extends BaseHttpClient {
   }
 
   public installPluginFromGithub(
-    assetUrl: string,
+    assetId: number,
+    releaseId: number,
     owner: string,
     repo: string,
     releaseTag: string,
   ): Promise<AsyncTaskCreatedResp> {
     return this.post('/api/v1/plugins/install/github', {
-      asset_url: assetUrl,
+      asset_id: assetId,
+      release_id: releaseId,
       owner,
       repo,
       release_tag: releaseTag,