Windows updater ignores GITHUB_TOKEN and fails when unauthenticated GitHub API quota is exhausted

What version of Codex CLI is running?

codex-cli 0.144.3 (first observed while updating from 0.144.1 to 0.144.3).

What subscription do you have?

N/A (standalone installer/updater issue)

Which model were you using?

N/A

What platform is your computer?

Windows x64 (Windows_NT)

What issue are you seeing?

codex update fails when the unauthenticated GitHub REST API quota for the current public IP is exhausted, even when GITHUB_TOKEN is explicitly set from a valid authenticated GitHub CLI session:

$env:GITHUB_TOKEN = gh auth token
codex update

Output:

Updating Codex via `powershell -ExecutionPolicy Bypass -c '$env:CODEX_NON_INTERACTIVE=1; irm https://chatgpt.com/codex/install.ps1 | iex'`...
Could not fetch GitHub release metadata for Codex latest. GitHub API may be unavailable or rate limited. The remote server returned an error: (403) Forbidden.
Error: `powershell ...` failed with status exit code: 1

The unauthenticated response confirmed the exhausted shared quota:

HTTP/1.1 403 rate limit exceeded
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
X-RateLimit-Resource: core

At the same time, the authenticated account had 4,975 of 5,000 core requests remaining. The current scripts/install/install.ps1 metadata request is:

$releaseMetadata = Invoke-RestMethod -Uri $metadataUri

It does not use GITHUB_TOKEN, GH_TOKEN, or the existing gh authentication.

This is related to #28538 / #31056, which reduced duplicate unauthenticated metadata requests and improved the error message. The remaining problem is that a single exhausted unauthenticated quota still makes updating impossible despite available authenticated quota.

What steps can reproduce the bug?

1. Exhaust the unauthenticated GitHub REST API core quota for the current public IP.
2. Authenticate GitHub CLI and export its token:

gh auth login
$env:GITHUB_TOKEN = gh auth token

1. Run:

codex update

1. Observe the GitHub API 403 shown above.

What is the expected behavior?

install.ps1 should use an authenticated metadata request when GITHUB_TOKEN or GH_TOKEN is set, while retaining the current unauthenticated fallback when neither is available. The authorization header should only be sent to the GitHub API metadata endpoint, not arbitrary redirected download URLs.

Additional information

Running the same official installer with an Authorization: Bearer ... header applied only to its Invoke-RestMethod metadata request succeeded immediately and updated Codex from 0.144.1 to 0.144.3.