Default runtime downloads to buildcurl.com

[crohr]

Summary

• use https://buildcurl.com when BUILDCURL_URL is unset
• preserve an explicitly injected local coordinator URL
• cover hosted fallback extraction without making a network request

This keeps released pkgr/action versions working during the local compiler rollout.

Validation

• rspec spec/local_buildcurl_spec.rb
• make lint-scripts
• bash -n bin/download-python-runtime
• git diff --check

[crohr]

@codex review

[crohr]

@codex review

[crohr]

CI note on c7e5468: lint and check-changelog pass. All three Hatchet integration jobs fail before exercising this change because HEROKU_API_KEY and HEROKU_API_USER are empty, producing Heroku API 401 Unauthorized responses. Local executable coverage passes with 3 examples and 0 failures.