fix(coverage): retry transient trusted uv archive failures without widening trust

[seonghobae]

Observed exact failure

Central OpenCode coverage run 31002427460, attempt 2, failed before executing pull-request code while reviewing ContextualWisdomLab/newsdom-api#524 at exact head 86f579ee6964642b98f3d44464adbdc7f0c8fa5b:

Could not materialize base Python locks: trusted uv archive download failed: HTTPError

The same exact-head review had already passed source materialization, archive extraction, replay protection, and changed-file syntax. The only changed file was AGENTS.md, so the subsequent requested-change review is infrastructure evidence, not a product-code finding.

The pinned uv 0.12.1 release and x86_64 Linux archive are current official immutable assets. The materializer correctly fixes the origin, disables proxies, rejects redirects, bounds bytes/time, verifies SHA-256, validates the exact regular archive member, and checks uv --version. It currently performs only one network attempt, so a transient 408/425/429/5xx response converts otherwise valid current-head coverage into a persistent CHANGES_REQUESTED review.

Required bounded behavior

Add test-first retry support without weakening the existing trust boundary:

• retain the exact literal https://releases.astral.sh/github/uv/releases/download/0.12.1/uv-x86_64-unknown-linux-gnu.tar.gz sink;
• retain no-proxy and no-redirect behavior;
• retry only a closed set of transient HTTP statuses (408, 425, 429, 500, 502, 503, 504) and transient connection/DNS/timeout failures;
• never retry certificate-verification, malformed-URL, redirect, checksum, archive-shape, member-type, size, or version failures;
• use a bounded attempt count and deterministic bounded backoff;
• open a fresh response for each attempt and discard every partial payload;
• preserve secret-free bounded diagnostics and final failure behavior;
• keep exact 100% statement/branch coverage and public docstrings.

Permanent regression evidence

Add deterministic tests that prove:

1. transient 503 followed by a valid short-read response succeeds on the second attempt;
2. repeated transient failures stop at the exact attempt ceiling;
3. 404 and TLS certificate verification fail immediately with no sleep;
4. each retry uses the same literal trusted origin and timeout;
5. partial bytes from a failed attempt never prefix the successful payload; and
6. the official archive SHA/member/version verification remains unchanged.

Update CHANGELOG.md and authoritative doctoring with availability, rollback, and APA 7 references to Python urllib.error, RFC 9110 retry-relevant status semantics, and the official immutable uv 0.12.1 release.

Acceptance

Merge only after the central quality workflow, Python Security, CodeQL, Semgrep, Security Scan, Secret Scan, OSV, SBOM, Scorecard, OpenCode, Noema, Strix, CodeRabbit, independent current-head approval, and branch protection succeed. Do not introduce a mutable downloader, alternate origin, unverified cache, GitHub Copilot credential, or reviewer-credential change.