fix(download): retry DNS server failures within the GET request budget

Stacks source CI repeatedly failed before its tests while installing native service dependencies with published Pantry 0.11.126. CI 40174227380, auth-3, failed downloading DynamoDB Local with NameServerFailure; CI 40174323082, auth-3, failed downloading MySQL with the same typed error. The retained logs name both registry.pantry.dev and the object-storage endpoint.

At owning source e23de64, packages/zig/src/io_helper.zig classifies TemporaryNameServerFailure as recoverable, but excludes NameServerFailure. The streaming header catch therefore returns immediately without using the existing idempotent GET retry budget.

A new native policy regression failed on that exact case with a fresh budget: zig test src/io_helper.zig -lc --test-filter "safe GET DNS server recovery", exit 1,0 pass/1 fail. It also requires invalid host names and cancellation to remain terminal and checks that the two existing retries share one budget and stop when exhausted.

Acceptance:

• Recover DNS server failures in the maintained native GET transport using the existing bounded policy.
• Preserve request deadlines, attempt limits, origin-scoped credentials, TLS verification, invalid-host errors and cancellation.
• Retain owning native regressions, run relevant checks and publish through the maintained patch workflow.
• Verify original release artifacts and normal downstream adoption. Rerunning a workflow is not proof that the downloader was repaired.

Related delivery tracking: stacksjs/stacks#2958 and stacksjs/the-settlers-iii-remake#25. No source CI/release gate may be bypassed.

Owning-source correction is pushed to main as Chris, without coauthors: 668818661. The published 126 source 91ded also lacks this error classification, matching the CI failures.

The new regression failed before the change and passes afterward. The complete native I/O module passed 81 tests, with 3 existing platform-specific skips and 0 failures; formatting, the normal native CLI build, CLI execution, root TypeScript checks and frozen install passed. Root lint reports 0 errors and 304 existing warnings. Review confirms this shared policy is used for GET/readback paths, not uploads. Attempts, deadlines, cancellation and TLS checks remain unchanged.

The maintained bun run release:patch completed with exit 0 and produced 0.11.127, immutable source c83f6d9. Required workflows are running: CI 40177111235, native build 40177111221, Deploy 40177111251, Releaser 40177111887. No new package or native binary has been qualified or adopted in Stacks/the game yet. Source CI failures and failed release gates remain retained.

The maintained v0.11.127 release is now qualified at immutable source c83f6d9.

All four exact-source workflows passed: CI, all-platform native builds and Windows CLI, registry deployment, and Releaser.

Independently checked all seven original native ZIPs against the release manifest and GitHub digests, complete archive bytes, CRC and executable architecture. The normal installer installed the exact original darwin-arm64 binary and it executes as pantry 0.11.127 (c83f6d9c8).

The original npm publisher proof artifact 12593089935 was checked against GitHub's SHA256 and ZIP CRC. The public ts-pantry@0.11.127 metadata and complete tarball match its original SHA1 and SHA512. A normal Bun install and frozen install succeeded; all 1824 installed package files match that original archive.

Adopting the verified CLI, SDK and exact-source Action pins into Stacks now. The fix retains the existing bounded GET-only recovery budget and terminal failures; no skipped gates or deadline increases. Source fix: 6688186.

The owning native GET retry policy is fixed in 6688186 and released as verified v0.11.127 (c83f6d9). Exact-source CI, all-platform builds, deployment and Releaser all passed. Original artifact and installed CLI/SDK evidence is recorded above. Stacks adopted the SDK and immutable Action pins in d2580b8 and triggered its maintained v0.75.306 release. Broader framework and game adoption remains tracked in stacksjs/stacks#2958.