fetch: client timeout, retry with backoff, url.JoinPath (closes #63)

fetch now makes every request through an http.Client with a time
limit, ten minutes by default and set with --timeout, which must be
greater than zero. A connection error, a timeout, or a 5xx or 429
response is retried, up to five tries in all, after a random wait
whose limit doubles from one second, or after the wait the server's
Retry-After asks for, up to one minute. Each try of a file starts a
new temp file, so a retry never keeps a partial file; the size and
hash checks are unchanged. Manifest and file URLs are built with
URL.JoinPath, so trailing slashes, query strings and names that need
escaping all work.

Model: opus-5-5

internal/cli/errmsg_test.go

@@ -272,10 +272,15 @@ func TestFetchManifestHTTPStatusMessage(t *testing.T) {
 		}))
 	defer server.Close()
 
-	set := flag.NewFlagSet("fetch", flag.ContinueOnError)
+	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
+
+	set := flag.NewFlagSet(cmdFetch, flag.ContinueOnError)
+	for _, f := range mfa.fetchCommand().Flags {
+		require.NoError(t, f.Apply(set))
+	}
+
 	require.NoError(t, set.Parse([]string{server.URL}))
 
-	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
 	ctx := urfcli.NewContext(nil, set, nil)
 
 	// fetchManifestOperation logs to the process-global logger.
@@ -293,8 +298,11 @@ func TestFetchFileHTTPStatusMessage(t *testing.T) {
 		}))
 	defer server.Close()
 
-	err := downloadFile(context.Background(), server.URL+"/x", "x",
-		&mfer.MFFilePath{}, nil)
+	// downloadFile logs each retry of the 500 to the process-global logger.
+	err := runLocked(func() error {
+		return downloadFile(context.Background(), testClient(), server.URL+"/x", "x",
+			&mfer.MFFilePath{}, nil)
+	})
 	require.ErrorIs(t, err, errHTTPStatus)
 	assert.EqualError(t, err, "HTTP 500")
 }