bug: extension release downloads do not handle stream failures

## What happened?

The GitHub-release extension downloader does not handle errors from either the HTTP response stream or destination file stream.

In `packages/cli/src/config/extensions/github.ts:517-561`, `downloadFile()` pipes the response into `fs.createWriteStream(dest)` and listens only for `finish`. It never installs an `error` handler on `res` or `file`, and it does not remove a partially written destination.

The request object's `error` handler only covers failures emitted by `https.get()` itself; it does not cover a response that errors after headers arrive or a write failure such as `ENOSPC` or `EACCES`.

## How can this be reproduced?

In the existing `downloadFile` unit-test setup:

1. Return a mocked response with status 200.
2. Return a mocked write stream from `fs.createWriteStream()`.
3. Call `downloadFile()` and emit `error` from the write stream instead of `finish`.
4. The error has no listener, so it becomes an unhandled EventEmitter error rather than rejecting the returned promise.

The same problem occurs if the response emits `error` after the request has succeeded.

## What did you expect to happen?

Any request, response, or filesystem failure should reject `downloadFile()` exactly once, close both streams, and remove incomplete output.

## Why this matters

Disk-full, permissions, and mid-transfer network failures can crash the CLI or leave extension installation hanging. A partial archive may also remain for later extraction or diagnostics.

## Suggested direction

Use `node:stream/promises.pipeline()` or equivalent coordinated cleanup, write to a temporary destination, and add tests for response errors, writer errors, and partial-file removal.

## Client information

Found by source audit on current `main`, commit `f47d6c6f7`. This is platform-independent stream handling; `/about` output is not applicable.

Inspect packages/cli/src/config/extensions/github.ts:517-561, especially downloadFile(), then run the existing downloadFile unit-test setup. Verify that response and destination-stream failures reject exactly once, both streams are closed, and incomplete output is removed. Add coverage for response errors, writer errors, and partial-file cleanup.

Written by the indexing model from the issue text.