fix: bound resource downloads

[victor0602]

Summary

• enforce overall and idle timeouts across response headers, body reads, and disk writes
• retry transient network, 408, 429, and 5xx failures with exponential backoff and Retry-After support
• cap download size using Content-Length and streamed byte counts
• write to a temporary file and atomically replace the destination only after a complete download
• propagate caller cancellation and clean up readers, writers, and temporary files on every failure path

Validation

• bun test test/files/download.test.ts
• bun run typecheck
• bun run lint
• bun test (459 passed)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}