CI: retry verified staged release downloads

[brandonpayton]

Why

prepare-merge previously attempted each staged archive download only once. A temporary GitHub release read could therefore fail an otherwise valid package promotion even when the immutable release and asset still existed.

This happened on PR #913: one libxml2 download reported release not found, while 70 sibling downloads succeeded and an unchanged retry later passed.

What changed

• Retry each exact staged archive download with a bounded exponential delay.
• Give every attempt a private temporary directory and discard partial bytes before retrying.
• Accept only a regular file, then keep the existing exact size and SHA-256 checks before publishing it to the promotion directory.
• Pass the selected release tag, archive name, digest, and size through environment variables so release metadata never becomes generated shell syntax.
• Cover transient success, permanent failure, partial bytes, success without a file, cleanup, exact arguments, unsafe input, and workflow wiring.

This changes package release controls only. It does not change Kandelo runtime behavior, ABI, package recipes, archives, or indexes.

Validation

Run through scripts/dev-shell.sh on exact commit 52d30d5c75ce8b5a8781a9d4e7f90b2986120fb5 / tree 7eb9754b1b26f6b406154e4b0366449281cd8964:

• verified release asset helper fixtures passed;
• merge-candidate workflow contract tests passed;
• change-scope classifier tests passed;
• Bash syntax and git diff --check passed;
• the full tests/scripts/package-publish-flow.sh suite passed.

The rebased commit has the same stable patch ID as the previously reviewed head. Independent devil advocate review approved this exact commit with no findings.

Merge

This PR receives standalone hosted validation because it changes archive-promotion release controls. It has no dependency on batch infrastructure. Merge only after the refreshed exact-head checks are green.

[brandonpayton]

Independent exact-head review: accepted at 2e1203083fc54a876bcba21c422acd1167eace12.

The review initially found that release-derived values were interpolated directly into shell source. That was fixed before this head by moving ARCHIVE_NAME and STAGING_TAG through the step environment, so the helper validates data before any path or output use.

No blocking correctness or security findings remain. The reviewer independently passed Bash syntax, all 12 focused fixture assertions, git diff --check, and a live download of the exact #913 libxml2 asset (688,219 bytes; SHA-256 0aadc385fdd2e88691936635057d07ce9c8a99b0b3c13392fc52bf8688abe031). The full prepare-merge execution remains CI evidence.

[brandonpayton]

CI diagnosis for exact head 2e1203083fc54a876bcba21c422acd1167eace12: this failure is a truthful base/index generation mismatch, not a retry-helper failure.

• This PR changes only CI files, so package_staging_required=false and binary materialization correctly used binaries-abi-v39.
• sdk: preserve static linker argument order #913's successful prepare run 29302528145 has already promoted its synthetic-merge generation into that shared index before sdk: preserve static linker argument order #913 itself merged.
• For example, the current index says Bash cache key 9fe79ff8... and zlib wasm32 3321b9fe..., both built_by run 29302528145; those are the exact successful sdk: preserve static linker argument order #913 promotion jobs.
• CI: retry verified staged release downloads #939 is still based on main without sdk: preserve static linker argument order #913, so it computes Bash 4fcd4793... and zlib wasm32 7d4944be... and correctly refuses the future-generation archives in fetch-only mode.
• The same mismatch affected all 71 requested packages, which is consistent with sdk: preserve static linker argument order #913 changing the SDK wrapper input shared by package cache keys.

No source-build fallback or cache bypass will be added. Once #913 merges, I will rebase #939 onto the resulting main and rerun the exact head. That is the first base where the package inputs and already-promoted ABI 39 index are expected to agree.

[brandonpayton]

Absorbed by rebase-merged #967. Main is now 6efb411 with the sealed tree b133bfa018f7e2bc84c4845edf2f945b2f844954, and ABI 41 activation completed successfully in run 29550069085. The absorption audit confirmed this PR\x27s behavior and tests are present in that merged tree, so this source PR is closed and its branch is deleted.