Validation steps fail on transient external download errors

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence

Found by the merge-queue failure count in #4993.

7 failed merge-group runs between 2026-09-23 and 2026-10-08 failed while a validation step downloaded something from an external registry or chart repository. The errors were rate limiting (HTTP 429), a DNS timeout, a connection reset and an HTTP 500.
Jobs: 🔏 Validate Cosign Matcher Efficacy (the steps that verify the Upbound and first-party Crossplane packages) and 🔐 Validate Production Authorization (step 🚦 Validate Actual Budget user-namespace pilot).
Evidence basis: logs for 4 of the 7 runs.
Examples: 37855936882, 35846118562, 36755370443.

A short outage at a third-party host evicts a candidate that changed nothing it fetches.

These steps retry a transient download error a bounded number of times, and still fail on a permanent error or a failed verification.

Rate limiting, DNS and connection errors and HTTP 5xx are retried with backoff, within a fixed bound.
A verification failure, a 4xx other than 429, or a retry budget that runs out still fails the step and names the error.
A test covers one transient error followed by success, and a permanent error.

Size: small. Part of #4979.