[eicherseiji]

The daily maintenance build fails when lua.org cannot be reached. Add retries and bounded timeouts to the Lua download, with the OSUOSL mirror as a fallback. The downloaded archive must pass the existing pinned SHA-256 check.

Creating a version bump PR leaves the checkout with the new HAProxy checksum. Restore the workflow commit before building the currently pinned version for its CVE scan.

Validation:

• Verified primary success, HTTP 503 retry, connection failure fallback, failure when both sources are unavailable, and corrupt archive rejection with the CI container's curl 7.29.0.
• Downloaded the actual Lua archive from OSUOSL after forcing the upstream request to fail and verified its pinned checksum.
• Simulated creating a bump commit and verified restoration of the pinned version and checksum while preserving the bump branch. Also checked the path without a version bump.
• Passed actionlint, Bash syntax, and whitespace checks. ShellCheck reports only the existing unused OPENSSL_MAJOR warning.