Support integrity-safe resumable HTTP downloads

Motivation

Current retry support deliberately starts every HTTP attempt from byte zero and removes the failed staging file. That is safe for ordinary artifacts, but expensive for multi-gigabyte immutable releases. eureka-bench has a checksum-pinned CatPred archive of 10,207,582,747 bytes; losing a connection near completion should not require another full transfer.

Downstream context: https://github.com/iskandr/eureka-bench/pull/254 and https://github.com/iskandr/eureka-bench/issues/255.

Proposed scope

Add an explicit opt-in resume mode for raw HTTP/HTTPS downloads. Preserve a stable private partial beside the destination, issue a Range request from its current size, and publish only after the complete installed bytes satisfy expected_size and expected_sha256.

Required safety behavior

• Require trusted integrity metadata for persistent/resumable partials, ideally SHA-256 plus size.
• Preserve an already valid destination throughout download, retry, validation, and publication.
• Validate 206 Content-Range starts at the requested offset; if the server returns 200 or an incompatible range, safely restart from zero.
• Record and enforce a strong validator when available (ETag and/or Last-Modified); discard a partial if remote identity changed.
• Handle a partial larger than expected, a complete-but-corrupt partial, 416, truncated streams, and servers without range support.
• Keep partials owner-only, constrain them to the destination directory, and never follow an unsafe partial-file type.
• Make retry/backoff continue from the last safely written offset.
• Report cumulative bytes and total size through the progress callback without double-counting retries.
• Allow callers to discard partials explicitly and document that resumable mode intentionally leaves bounded staging state after interruption.

Acceptance tests

Use a local HTTP fixture supporting Range, validators, dropped connections, ignored ranges, wrong Content-Range, and remote replacement. Test successful resume, safe restart, final integrity failure, Ctrl-C preservation, concurrent callers, and unchanged non-resumable behavior.

Start by reading the existing HTTP download and retry path, then run the local HTTP fixture tests described in the issue. Done means opt-in downloads safely resume with trusted metadata, preserve valid destinations, handle the listed range and interruption cases, report progress correctly, and leave non-resumable behavior unchanged.