fix(cli): permitted canary prerelease assets in binary repair

- Threaded the selected channel through the binary download path so a stale canary launcher can be repaired with its exact-tag prerelease asset instead of failing.
- Kept draft releases and stable-channel prereleases rejected.
- Added resolver and shim-takeover tests for the canary allowance.

Fixes #9806