Harden large prebuilt template acquisition

[joecklau]

Summary

• force the large Docker Sandboxes Full prebuilt archive transfer to negotiate HTTP/1.1 explicitly, including TLS ALPN, after reproducible GHCR HTTP/2 stream resets near 14.35 GiB
• retry one transient immutable-digest package fetch or archive materialization failure and remove incomplete archives before retry or exit
• preserve the existing HTTP/2 path for Act and add focused fetch, transport, partial-cleanup, and failure-classification coverage

Live amd64 evidence

• candidate index: sha256:2a3ab59e2e60a1b343f66f22f0471866a3add9c08f6c3703adf30a3bfa189008
• completed the 19,034,730,496-byte verified archive transfer over HTTP/1.1, passing the prior repeatable 14.35 GiB reset point
• imported/read back Sandbox template cache id 13c02dae641b
• Playwright Docker workflow passed twice: https://github.com/solutionforest/ephemeral-action-runner-test/actions/runs/31476777634
• Docker Hub private pull workflow passed twice: https://github.com/solutionforest/ephemeral-action-runner-test/actions/runs/31476780404
• verified repeated ephemeral runner termination, exact cleanup, replacement, GitHub registration, and online recovery
• final cleanup removed the exact GitHub runner and Sandbox; sbx ls --json returned no Sandboxes; dedicated staging root was empty
• active receipt SHA-256: e05916a4c64ccda40ea3d038ad25111723ec75f2e1a23933976672e931a97590

Validation

• go test ./internal/image -run 'Test(DockerSandboxesPrebuilt|ImageDependency)' -count=1
• go test -race ./internal/image -run 'Test(DockerSandboxesPrebuilt|ImageDependency)' -count=1
• go vet ./internal/image
• go test -run '^$' ./...
• git diff --check

Remaining gate

• keep this PR draft until the same exact candidate and branch pass native Mac arm64 Playwright Docker and Docker Hub private-pull acceptance with lifecycle replacement and exact cleanup evidence