feat(cli): narrow fast_provision experiment to images-only

[AhmedTMM]

Summary

• Drop tarball from the fast_provision PostHog experiment's test variant — bucketed users now only get images flipped on, not tarball + images.
• Cleaner attribution: the A/B hypothesis isolates the marketplace-image boot-time speedup. Tarball install stays available via explicit --beta tarball or --fast.
• Bumps CLI to 1.0.24.

Test plan

• bunx @biomejs/biome check src/ — clean
• bun test src/__tests__/feature-flags.test.ts — 11/11 pass
• Full bun test — only 4 pre-existing cross-file fetch-mock pollution failures (cmdrun-happy-path, hetzner-cov, digitalocean-token), all pass in isolation. Unrelated to this diff.

🤖 Generated with Claude Code

[la14-1]

Review

Small, mechanical narrowing of the `fast_provision` `test` variant from `tarball + images` → `images`. Code change is fine; the real questions are upstream of the code.

Looks good

• One-line diff, comment updated to match. No test changes needed (the flag-evaluation tests don't assert on which betas get pushed).
• Still respects `userOptedIntoBeta` — users who explicitly pass `--beta` or `--fast` get the full set.

Must-fix before merge

• Version collision. Main is now at 1.0.25 (after feat(cli): --repo accepts any git URL, not just GitHub slugs #3364 landed). This PR bumps `1.0.23 → 1.0.24`, which rewinds the version. Rebase and bump to `1.0.26`. PR is currently `mergeStateStatus: UNKNOWN` (draft + stale base) — rebase will also refresh that.

Worth confirming before flipping

• Is the PostHog experiment already collecting exposure data under the old `tarball + images` definition? If yes, changing what `test` means mid-flight pollutes the dataset. Two clean options:

  1. Pause/reset the experiment in PostHog, clear prior exposures, restart with the new definition.
  2. Rename the flag to `fast_provision_v2` so old + new data don't mix.

  This is a process call, not a code one, but worth getting right before merging.

• Timing relative to fix(tarball): rewrite absolute /root symlinks after non-root extract #3368. This PR was opened before the tarball symlink fix (fix(tarball): rewrite absolute /root symlinks after non-root extract #3368, merged as `762508e9`) landed. The original motivation for narrowing was arguably the tarball bug confounding measurement. With fix(tarball): rewrite absolute /root symlinks after non-root extract #3368 in, keeping tarball in the test arm is now defensible — the original feat(cli): posthog feature flags + fast_provision experiment #3366 rationale ("hypothesis is specifically about tarball/image") still holds.

  If the goal is cleaner attribution, narrowing to images-only is still the right call. If the goal was working around the dangling-symlink bug, that's solved and tarball could stay in. The PR description says "cleaner attribution," which is the stronger argument — just flagging the context.

Nit

• Consider adding a single unit test that asserts `betaFeatures` contains exactly `["images"]` when the flag returns `test` and the user didn't opt in — cheap guard against a future "oops pushed tarball back in" regression. Not blocking.

Draft state

PR is marked draft; treat this as pre-review feedback. Ready it once the rebase + version bump is in and you've decided on the PostHog experiment reset question.

Reviewed by SPA

[la14-1]

Rebased onto main + bumped to 1.0.26. Per-request, skipping the unit-test nit.