voxora-hf HfClient has no HTTP retry / backoff; single 503 aborts the whole resolve

## What

`voxora-hf/src/client.rs::HfClient::execute` calls
`builder.send().await` exactly once and surfaces any error to
the caller. `voxora-hf/src/source.rs::CacheResolver::run`
returns the first error from `try_join_all`; one bad sibling
aborts the whole download even though the other files could have
succeeded.

Hugging Face returns HTTP 503 under load and the wiremock test
suite has no test for transient 5xx / 429 / connect-timeout
retry. The current behaviour is "one transient blip burns the
operator's only chance to publish that tag in the 30-min OIDC
window" for a multi-crate coordinated publish.

## Recipe

Add a small retry policy in `HfClient::execute`:

- Bounded retries (3 attempts) on `reqwest::Error` whose
`is_timeout()`, `is_connect()`, or `is_request()` are true.
- Bounded retries on HTTP 5xx and 429 (respect the
`Retry-After` header when present).
- Exponential backoff with jitter (start 250 ms, double each
attempt, cap at 4 s, ±25 % jitter).
- Log every retry via the existing tracing events.
- Surface a new `HfError::RetriesExhausted { url, attempts,
last_error }` variant when the budget runs out, so callers
can distinguish a transient outage from a deterministic 4xx.

Idempotent GET, so the retry is safe on the body side; the only
state at risk is the in-flight `tmp` file from
`HfClient::get_to_file`, which #103 already makes unique per
attempt.

## Acceptance

- A wiremock test that returns 503 twice then 200 on the third
attempt is asserted to succeed and reach the `3`-attempt
budget.
- A wiremock test that returns 503 every time is asserted to
fail with `HfError::RetriesExhausted` after exactly 3
attempts.
- A wiremock test that returns 200 on the first attempt
(control) is asserted to complete in 1 attempt.
- `cargo test --workspace --all-targets` stays green.