Replace the Rust curl shim with real curl

Today curl in the VM is a Rust reimplementation (secure-exec/registry/native/crates/commands/curl, shipped as @agentos-software/curl, source: "rust"), not real curl. It diverges from curl's CLI — e.g. it rejects a bare hostname:

:/$ curl google.com
curl: unsupported argument `google.com`

Real curl normalizes google.com → http://google.com; the shim does not, and likely lacks many flags/behaviors.

Goal: ship real curl so behavior matches upstream.

Options

1. Compile real curl (C) to wasm32-wasip1 with libcurl + a TLS backend (wasi-compatible mbedTLS/wolfSSL/BearSSL), packaged like the other C registry commands. Highest fidelity, most effort (TLS-on-WASI is the hard part).
2. Close the gap in the Rust shim as an interim: scheme normalization for bare hosts, common flags (-X, -H, -d, -o, -L, -s, -I), correct exit codes.

Recommendation: do (2) as a quick fix now (covers the reported breakage), track (1) as the real solution.

Implementation lives in secure-exec registry/software/curl + registry/native. Surfaced from just shell testing.

Related: the WARN could not retrieve pid for child process line also leaks into shell output on this path (separate shell-stripper bug).

Start in secure-exec/registry/software/curl and secure-exec/registry/native, then run the curl path from just shell. Determine whether the interim Rust shim or the real curl WASI packaging is in scope. Done means bare hostnames and the stated common flags behave like curl, with correct exit codes and without conflating the separate shell-stripper warning.