fix(tooling): replace custom tool downloads with maintained-client acquisition

[doublewhy]

Problem and outcome

Required checks depend on upstream binary releases. The original incident involved transient GitHub Releases disconnects and 503s before Conftest, Gitleaks, Vale or OSV could run. Under #1168 / ADR-106, this issue now replaces repository-authored transport with a qualified maintained client and reviewed artifact identity.

PR #1140 is closed without merging. Its custom HTTP/socket/redirect/framing implementation is rejected; do not resurrect it or reproduce it around another HTTP library.

Scope and acceptance

• Consume the reviewed artifact/platform authority from build(tooling): define reviewed development artifact locks and policy #1216 and qualified bootstrap clients from build(tooling): qualify maintained bootstrap clients and host profiles #1217.
• Replace acquisition for Conftest, Gitleaks, Vale and OSV with fixed-argv maintained curl invocation, local input support and finite native retry/transfer/size/process budgets.
• Delete tools/http_download.py after migrating all its consumers; remove obsolete production HTTP code and transport-only tests/suppressions while retaining meaningful native-client and installer regression coverage.
• Move Conftest/Gitleaks integrity selection from live checksum metadata into reviewed per-platform raw/installed digests; preserve Vale/OSV pins and existing OSV safeguards.
• No repository retry loop, Retry-After parser, redirect traversal, socket reader, proxy/TLS/framing or HTTP timeout logic remains. Native client behavior supersedes the original exception-by-exception retry request.
• No insecure TLS, credential-in-URL, user curlrc, credential forwarding across origins or broad retry-all-errors. Enterprise host egress policy belongs to maintained proxy/firewall infrastructure.
• Integrity/type/archive/signature/identity failures are terminal outside transport retries; availability fallback selects only approved identical bytes.
• Safe stable diagnostics and required-lane hard failures remain. Unsupported client/platform preflight fails clearly.

Verification and follow-on boundaries

Execute T01, T02, T08–T10 and T23 in docs/decisions/package-artifacts/operations.md against the actual qualified client. Preserve installer integrity tests; T08 exercises native HTTP behavior with controlled fixtures.

#1219 owns subsequent shared local-cache concurrency improvements; #1220 and #1221 own the separate Isabelle and vocabulary acquisition paths. This issue is not a larger downloader, a runtime module-registry rewrite or a vulnerability-gate weakening.

Implementation starts after maintainer acceptance of #1168. Native GitHub dependencies encode the gate and prerequisites.

[doublewhy]

Additional CI evidence from the current successor PR set:

• PR fix(proof): make offline Isabelle replay portable on Ubuntu #1131, run https://github.com/OpenRAE/rae/actions/runs/31638606534: the unit, integration, contract, static, and proof work completed, while Vale and OSV acquisition failed with RemoteDisconnected.
• PR fix(runtime): reconcile workflow timeouts fail closed #1132, run https://github.com/OpenRAE/rae/actions/runs/31639240594: Conftest priming and OSV acquisition both failed with RemoteDisconnected before the affected checks could exercise project code.
• PR fix(release): gate publication on the verified release SHA #1138, run https://github.com/OpenRAE/rae/actions/runs/31638450185: the reusable canonical verifier passed unit, integration, contracts, static analysis, and the Isabelle proof, then failed only when the pinned Vale asset download disconnected.

These are independent branches and runner attempts with the same failure class. This reinforces the acceptance criterion: retry only bounded transport failures while preserving exact origin, version, digest/signature checks, and fail-closed behavior for any integrity mismatch.

[doublewhy]

Temporarily held pending post-#1113 evidence and the breaking-change freeze. Merged #1113 already provides one shared bounded retry helper for Conftest, Vale, Gitleaks, and OSV. Before resuming this issue, record at least one reproducible transient acquisition failure on a commit containing #1113 and narrow any follow-up to the missing behavior. PR #1140 remains draft and unmerged.

[Brad-Edwards]

Deferred. Points to larger issue of maturing artifact/package management in the CI/CD. Milestone created to mature that.

Custom HTTP stack will not be merged as it will be superseded by a mature package management solution.

[Brad-Edwards]

Deferred under #1168 and the Developer Package & Artifact Management milestone. #1168 blocks this issue through GitHub’s native dependency graph. The repository-owned HTTP transport direction is not an accepted implementation; #1137 will be dispositioned or re-scoped after the package/artifact-management architecture is accepted.