WSL --install fails with "Forbidden (403)."

Nobody has claimed this yet.

### Windows Version

Microsoft Windows [Version 10.0.26200.8246]

### WSL Version

0.0.0.0

### Are you using WSL 1 or WSL 2?

- [ ] WSL 2
- [ ] WSL 1

### Kernel Version

_No response_

### Distro Version

_No response_

### Other Software

_No response_

### Repro Steps

Be on a network connection where there is a TLS inspection proxy (MITM) using its own CA certificate to sign server certificates for TLS connections. For example, use Cloudflare WARP in "Gateway with WARP" mode with TLS inspection on, but it is not limited to that.

Add the CA certificate to the certmgr "Trusted Root Certification Authorities", enable it for all purposes.

Run `wsl --install` in an administrator PowerShell window.

### Expected Behavior

`wsl --install` should be able to download and install whatever it needs.

Alternatively, it should output some details so that we can see what URL is failing, and whether it is due to an untrusted TLS certificate issue, or the URL is being blocked.

I think it is network related because when I change a network, it writes a message about downloading something. However, I need more details from the failure to troubleshoot what is going wrong on this network.

### Actual Behavior

The output is:

```
Forbidden (403).
```

### Diagnostic Logs

[WslLogs-2026-04-23_17-10-16.zip](https://github.com/user-attachments/files/27004941/WslLogs-2026-04-23_17-10-16.zip)

Start by reviewing the attached WslLogs-2026-04-23_17-10-16.zip and reproducing `wsl --install` on a network using TLS inspection. Trace the download failure to determine whether the certificate or URL is rejected, then make the failure identify the relevant cause or endpoint and verify it with the reported setup.

Written by the indexing model from the issue text.