Revert "Bump duo-cli version from 9.27.0 to 9.29.0 in StartWorkflowService"

What does this MR do and why?

Reverts !260311 (merged) by setting DUO_CLI_VERSION in Ai::DuoWorkflows::StartWorkflowService back from 9.29.0 to 9.27.0.

This MR is for INC-15070. Since 9.29.0 reached gprd (2026-10-12 05:04–05:34 UTC), the tool_use SLI error ratio of duo-workflow-svc has gone from about 1–4% to 25–40%. The find_files failure ratio in code_review flows has gone from about 0% to 85–99%.

Root cause

gitlab-org/editor-extensions/gitlab-lsp@e75d2c37 is in Duo CLI 9.29.0. It extracts the embedded rg to $XDG_RUNTIME_DIR or ~/.cache/gitlab-duo/bin, and it no longer falls back to the temp directory. The CI sandbox mounts $HOME read-only and clears XDG_RUNTIME_DIR, so the extraction fails, rg is unavailable, and find_files fails:

[RgBinaryProvider] Failed to extract rg from /$bunfs/root/rg-wk7861fv.: Error: EROFS: read-only file system, mkdir '/root/.cache/gitlab-duo'
[RipgrepService] rg is unavailable: Error: Could not extract the embedded rg to a private directory; set GITLAB_BIN_DIR to a directory only you can write

Example job: https://gitlab.com/gitlab-org/gitlab/-/jobs/17105964269#L2407

Scope

• This MR fixes jobs that use a custom image, because those jobs download DUO_CLI_VERSION.
• Jobs that use the default image workflow-generic-image:v0.0.22 still run 9.29.0, because it is preinstalled there. Reverting !261168 (merged) fixes those jobs.
• IMAGE_PATH is not changed here, so this MR does not conflict with that revert.

How to verify

Start a flow from a mention on a project that uses a custom image, for example image: python:3.12. The job log shows Downloading duo-cli 9.27.0, and the log contains no rg is unavailable lines.

🤖 Generated with Claude Code