Add retries to the install action for resilience (#2608)

## What

Make the `stellar/stellar-cli` install action resilient to transient
network failures by adding retries to its two network-dependent steps:

- **Binary download:** the `curl` call now retries up to 5 times with
backoff (`--retry 5 --retry-delay 5 --retry-connrefused
--retry-all-errors`), bounded by `--connect-timeout 30` and `--max-time
300`. The download now goes to a file (`$RUNNER_TEMP`) before being
extracted by `tar`, rather than piping `curl` straight into `tar`, so
that a retried transfer can safely restart without corrupting the tar
stream.
- **Attestation verification:** the `gh attestation verify` step, which
also hits the network, is now wrapped in a retry loop (5 attempts with
exponential backoff) before failing.

## Why

A single transient network blip previously failed the whole job — for
example [this rs-soroban-sdk
run](https://github.com/stellar/rs-soroban-sdk/actions/runs/27120352954/job/80046147824)
failed during the install step. With retries in place, a momentary
failure is retried instead of failing the build.

This mirrors the approach taken in
[stellar/actions#104](stellar/actions#104),
which added curl's built-in retry flags to harden a similar download
path.

Author: leighmcculloch

action.yml

@@ -66,7 +66,17 @@ runs:
         file="stellar-cli-$version-$os_arch.tar.gz"
         url="https://github.com/stellar/stellar-cli/releases/download/v$version/$file"
         echo "$url"
-        curl -fL "$url" | tar xvz -C $HOME/.local/bin
+        archive="$RUNNER_TEMP/stellar-cli.tar.gz"
+        curl -fL \
+          --retry 5 \
+          --retry-delay 5 \
+          --retry-connrefused \
+          --retry-all-errors \
+          --connect-timeout 30 \
+          --max-time 300 \
+          -o "$archive" \
+          "$url"
+        tar xvz -C $HOME/.local/bin -f "$archive"
 
     - name: Verify binary against attestation
       shell: bash