Switch build.rs from curl to ureq with bounded retries

The bundled-CLI build path (gated by the embedded-cli feature and the
COPILOT_CLI_VERSION env var) previously shelled out to `curl` to fetch
SHA256SUMS.txt and the platform tarball from the copilot-cli releases.
Two problems with that:

1. Implicit system dependency. `expect("curl is required ...")` panics
   when curl isn't on PATH — true on minimal Windows MSVC environments,
   some Docker images, and the CI matrices crates.io publishers tend
   to validate against. crates.io build environments themselves don't
   guarantee curl.

2. No retry on transient errors. Network blips during CI bundling
   surfaced as build failures rather than self-healing waits.

Switch to ureq 2 with default-features=false + ["tls"] (rustls +
webpki-roots, pure-Rust TLS, no OpenSSL or native-tls). Adds about
1.7MB and ~12 transitive deps to the build graph but only when the
embedded-cli feature is on; the default cargo build is unaffected.

Retry policy:
- Up to 3 retries (4 total attempts) with exponential backoff:
  1s, 2s, 4s.
- 5xx responses, connect timeouts, read timeouts, and other
  transport-layer errors are treated as transient and retried.
- 4xx responses fail fast (the URL is wrong; retrying won't help).

Connect/read timeouts (30s/120s respectively) prevent indefinite
hangs on stalled connections. The cache-hit path still bypasses
the network entirely; only fresh downloads pay the HTTP cost.

End-to-end smoke test against
https://github.com/github/copilot-cli/releases/download/v1.0.39 :
SHA256SUMS download succeeded, tarball download succeeded
(134MB extracted, 44MB compressed), SHA-256 verified, embedded
build succeeded.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: tclem

rust/CHANGELOG.md

@@ -404,6 +404,17 @@ public surface.
   field `with_*_opt` setters intentionally omitted to keep the
   primary API surface small).
 
+#### Build infrastructure
+- `build.rs` no longer shells out to `curl` for the bundled-CLI
+  download. The `embedded-cli` feature now downloads the
+  `SHA256SUMS.txt` and platform tarball through `ureq` (rustls TLS,
+  pure-Rust, no system dependencies). Removes the implicit `curl`-
+  on-PATH requirement that previously broke the build on minimal
+  Windows / container environments. Includes bounded retries with
+  exponential backoff (1s/2s/4s) on transient failures (5xx,
+  connect/read timeouts, transport errors) — 4xx responses still
+  fail fast as before.
+
 ### Fixed
 - `SessionUi::elicitation` (and the `confirm` / `select` / `input`
   convenience helpers that delegate through it) now sends the user-supplied