ci: make download-and-unpack retry-safe against truncated responses

`wget -qO- | tar xzf -` can't recover from a half-finished download —
the partial bytes are already in tar's stdin by the time wget's retry
logic could fire, and tar bails with "gzip: stdin: unexpected end of
file" before anything restarts. We've seen this hit one cell of a
22-cell matrix run on libcurl 8.17.0's tarball (run 26722785133), with
the other 21 cells succeeding on the same input — classic curl.se /
GitHub-releases flake.

Stage the download to a temp file first so wget can retry until the
file is whole, then untar from the file. Also pass --tries, --timeout
and --retry-connrefused so transient network errors don't fall through
to a hard failure on the first attempt.

This is also incidentally happening as I write this commit — curl.se is
serving the tarball at ~1MB/s today, which would make the previous
script's per-attempt timeout window much more likely to clip.

Author: JCMais

scripts/ci/download-and-unpack.sh

@@ -5,10 +5,22 @@ set -euo pipefail
 # download tar gz file from source_url and unpack it to destination
 # download_and_upack <source_url> <destination>
 download_and_unpack() {
-  mkdir -p $2
-  # User agent for Edge on macOS 
-  wget -U "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36 Edg/94.0.992.38" \
-       -qO- $1 | tar xzf - -C $2
+  mkdir -p "$2"
+  # Download to a temp file first instead of streaming straight into tar.
+  # The previous `wget -qO- | tar xzf -` pipe couldn't recover from a
+  # truncated response (e.g. curl.se/GitHub-release occasional hiccups) —
+  # tar consumes the partial bytes immediately and fails with
+  # "gzip: stdin: unexpected end of file" before wget's own retry can fire.
+  # With a temp file, wget can retry until the file is whole, and we only
+  # touch tar once.
+  local tmpfile
+  tmpfile=$(mktemp)
+  trap "rm -f \"$tmpfile\"" RETURN
+  # User agent for Edge on macOS
+  wget --tries=5 --waitretry=3 --timeout=30 --retry-connrefused \
+       -U "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36 Edg/94.0.992.38" \
+       -qO "$tmpfile" "$1"
+  tar xzf "$tmpfile" -C "$2"
 }
 
 if [ "${1}" != "--source-only" ]; then