Download installer archive before decompression

[richardchesse]

Summary

• download the compressed Hermit binary to a temporary archive before decompressing it
• keep user curl configuration enabled without allowing --write-out diagnostics to corrupt the archive stream
• remove partial downloads on curl errors and reject missing or empty archives
• keep both embedded installer templates synchronized

Why

The installer previously piped curl's stdout directly into gzip. If a user's curlrc configured diagnostic output with --write-out, those bytes were mixed into the archive stream and decompression failed. Disabling curlrc globally, as proposed in #603, avoids the symptom but also ignores every user's curl configuration. Downloading to a file isolates the response body while preserving curlrc behavior.

Validation

• ./bin/go test ./...
• generated-installer parity check
• Shellcheck on the generated installer
• regression harness with curlrc --write-out output
• rejection test for a zero-byte download