fix: bound resource downloads

[victor0602]

Summary

• enforce overall and idle timeouts across response headers, body reads, and disk writes
• retry transient network, 408, 429, and 5xx failures with exponential backoff and Retry-After support
• cap download size using Content-Length and streamed byte counts
• write to a temporary file and atomically replace the destination only after a complete download
• propagate caller cancellation and clean up readers, writers, and temporary files on every failure path

Validation

• bun test test/files/download.test.ts
• bun run typecheck
• bun run lint
• bun test (459 passed)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[NianJiuZst]

No blocking findings on the current head. The implementation bounds headers/body/disk stalls, enforces declared and streamed sizes, preserves the destination until a completed write, and cleans up failed attempts; I recommend merging it.

Verified locally: typecheck, lint (one pre-existing warning), build, 14 focused download tests, and the full suite (459/459). This does not include a multi-gigabyte or real slow-network download.