Preserve reviewed CLI digest pins when refresh reads fail #424

🤖 Generated by the Agentic Engineer

The checksum refresh validates new release entries, but suppresses failures while reading the existing reviewed manifest. A failed read can therefore replace that file without its earlier version pins. Its download also needs a bounded HTTPS request that ignores ambient curl configuration.

Acceptance: reproduce the retained-pin loss on a failed read; fail before replacement and preserve exact manifest bytes; perform replacement on the same filesystem; bound the checksum request and redirects to HTTPS; retain all platform, duplicate-entry and idempotence controls. The native scheduled updater and first populated release remain in #280.

Part of #280.