fix: share retry logic across HTTP downloads

[decofe]

Motivation

Bootstrap binary and attestation downloads bypassed the Rust retry policy, and Rust downloads stopped retrying once response headers arrived. A dropped response body could therefore still fail an installation after the request succeeded.

Solution

• Run HTTP requests, response-body reads, and attestation validation inside one retry loop. Mixed transport and missing-hash failures share one budget: six attempts and 31 seconds of backoff by default. Malformed attestations and verification failures are permanent; file retries truncate partial output.
• Route bootstrap binary and attestation downloads through one curl/wget wrapper using the same transient HTTP statuses, FOUNDRYUP_MAX_RETRIES, and 1/2/4/8/16-second capped backoff. Disable wget's internal retries to avoid multiplying attempts.
• Keep optional 404 handling, and fail bootstrap verification downloads after other errors exhaust their retries. Leave Git/Cargo source-build networking to those tools.

Validation

• 69 Rust unit tests pass in 0.08 seconds locally, including mixed HTTP/body/validation failure exhaustion and permanent validation failures. The async loopback HTTP fixture and retry tests share a paused Tokio clock, so backoff never sleeps in real time.
• 57 offline CLI/installer tests pass sequentially, including both curl and wget retry paths. Parallel CLI testing previously hit the existing running-binary guard; the sequential run passes.
• Nightly formatting and Clippy with warnings denied pass; ShellCheck passes.
• The 12 tests that download/install live releases or check live self-updates were not run locally.

Review

Reviewed the complete diff against master, including retry classification and budgets, attestation verification, optional 404 handling, partial-file replacement, bootstrap transports, and tests. Fixed nested retry budgets and a shell case where a local I/O error could be retried when a transient HTTP status was also present. No remaining findings identified in this review.

Prompted by: @DaniPopes