Fail early when an API-only flow's image has no curl

What does this MR do and why?

Flows with coding_environment: none (for example recommend_reviewers/v1) skip the project's setup_script but still run in the image from .gitlab/duo/agent-config.yml. When that image relies on setup_script to install curl, the duo-cli download fails with curl: command not found, which doesn't tell the customer what to fix. In gitlab-org/cli, every recommend_reviewers session since 2026-10-19 has failed this way on debian:bookworm-slim.

This MR keeps the configured image and checks for curl before downloading duo-cli. If curl is missing, the job stops with a clear message. For flows that skip setup_script, the message says so and tells the customer to add curl or duo to the image.

Details

• An earlier version of this MR switched these flows to the instance image. That changes which registry the job pulls from without the customer knowing, and locked-down runners (common on self-managed) would then fail to pull. Keeping the configured image leaves the customer's config in charge and makes the change safe to backport to 19.5.
• The check only runs when duo is not already in the image, inside the existing download block.
• image_source tracking is unchanged from master.
• Docs: the none row in custom_flows_schema.md now says the flow runs in the configured image, so that image must include curl or duo.
• gitlab-org/cli still needs a config change (add curl to its image) for Recommended Reviewers to work there.
• Failing job example: https://gitlab.com/gitlab-org/cli/-/jobs/17356769132

How to set up and validate locally

bin/rspec ee/spec/services/ai/duo_workflows/start_workflow_service_spec.rb ee/spec/services/ai/duo_workflows/update_workflow_status_service_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.