fix(download): enforce three total attempts

[rldyourmnd]

Summary

• use two curl retries after the initial request in every reusable download path
• cover private security, actionlint, ShellCheck, Gitleaks, OSV, Hadolint, Qt, and Flutter downloads
• add a repository-wide validator preventing retry counts above two
• preserve checksum, permanent-failure, and readiness semantics

Validation

• full isolated validate_all.py: all checks green
• actionlint
• no reviewed workflow/script contains a retry count above two

Permissions and threat model

No permissions or trust boundaries change. Fewer retries reduce duplicate external requests; verified integrity and fail-closed behavior remain unchanged.