Reject failed library downloads before clearing installed libraries

[danoli3]

Library downloads can report success after an HTTP failure and then reach extraction with a missing, truncated or HTML response instead of an archive. If remote digest lookup is unavailable, download_libs clears installed library directories before discovering the bad package, leaving a partial installation. Tar diagnostics are also suppressed.

Make curl downloads fail on HTTP errors and fail early across parallel transfers. Preserve curl/wget/wget2 exit status instead of allowing optional connection cleanup to mask it. Validate every downloaded tar/zip archive before any platform cleanup, and show extraction errors. Fetch digest metadata for the exact named release tag, with bounded retries/timeouts.

Observed with latest macOS bundles: extraction failed on bundle 3 after a 55.7 MiB transfer and unavailable digest map. The current published third archive is 40,576,583 bytes; an independent download matched GitHub's SHA-256 digest and fully extracted successfully. The transfer total matches bundles 1+2 alone, suggesting a missing/invalid third download rather than a broken published archive. The original failed file/HTTP response was not available for inspection.

Validation:

• Normal and silent curl HTTP failures propagate; wget failures propagate.
• Valid tar/zip archives pass; HTML, truncated, empty and missing archives fail.
• Actual download_libs installer fixture with unavailable digests and an invalid third bundle stops before removing an existing installed-library sentinel.
• Tests pass under Bash 3 and current Bash; syntax, workflow lint and diff checks pass.
• Independently downloaded, hashed and fully extracted the current Apothecary macOS bundle 3.

Adds a focused Ubuntu validation workflow. Does not rebuild or replace Apothecary release assets.