Retry transient release-download failures when installing supply-chain tools #4023

🤖 Generated by the Agentic Engineer

Evidence

On 2026-09-21 between ~14:50Z and ~15:21Z, 🧪 Validate Manifests failed on platform#4020 and platform#4022 (and again on #4022's re-run) in 🔐 Exercise verified supply-chain tools, with curl: (22) The requested URL returned error: 504 while downloading a pinned release asset from GitHub. Neither PR touches that step; a sibling PR from the same base passed it minutes earlier. The same 504 class hit an unrelated golangci-lint install in devantler-tech/actions in the same window.

Affected audience and impact

Every platform PR's required manifest validation, and the merge-queue production deploy, which installs the same tools before signing. One momentary 5xx from GitHub's release download fails the job outright, because both downloads run once with no retry.

Expected behaviour

A transient HTTP 5xx or timeout on either download is retried a few times before the step fails. Digest verification is unchanged: retried bytes are still checked against the reviewed pin, and a persistent failure still fails closed.

Acceptance criteria

• Both downloads pass curl's retry options (RED/GREEN in the installer's test).
• A persistent download failure is still refused and installs nothing (existing test).

Size: XS.