Bound package download timeout across headers and streaming

[Copilot]

The review identified that the intended 10-minute download timeout only covered response headers, while body streaming could stall indefinitely. This update applies a single timeout budget to the full download lifecycle.

• Timeout semantics

  • Set HttpClient.Timeout to Timeout.InfiniteTimeSpan to avoid split timeout behavior when using streaming.
  • Added a 10-minute CancellationTokenSource and used it as the single timeout mechanism.

• Download path update (Program.cs)

  • Switched to GetAsync(url, HttpCompletionOption.ResponseHeadersRead, token) so header fetch is cancellable by the same token.
  • Passed the same token to CopyToAsync and FlushAsync so stalled stream copy is also bounded.

using var httpClient = new HttpClient { Timeout = Timeout.InfiniteTimeSpan };
using var timeoutCts = new CancellationTokenSource(TimeSpan.FromMinutes(10));

using var response = await httpClient.GetAsync(
    url,
    HttpCompletionOption.ResponseHeadersRead,
    timeoutCts.Token);

await response.Content.CopyToAsync(fileStream, timeoutCts.Token);
await fileStream.FlushAsync(timeoutCts.Token);