Fix Windows dependency downloads and offline cache selection

[coneilen]

Summary

Fix the two Windows CI failures observed at the retained GraphCode provider pin without changing terminal/runtime behavior or moving the retention tag.

The target is explicitly coneilen/winghostty, base graphcode-host, as confirmed by the fork owner.

Fixes

• Replace BITS transfers with curl.exe, supporting GitHub archive responses without Content-Length and chunked responses. Preserve redirects, fail on HTTP errors, bound connection/transfer time, and promote only complete downloads from unique partial files. Failed transfers remove their partial output; optional failures are reported.
• Stop forcing the offline consumer back to .zig-global-cache. It now uses the same inherited/resolved cache as the seeder, including setup-zig's .zig-cache selection.
• Run loopback download regressions and the real offline-cache regression in both PowerShell 7 and Windows PowerShell 5.1.
• Document cache behavior and download guarantees.

Reproductions and evidence

RED: The old downloader reproduced BITS 0x80200011 against a loopback response without Content-Length. This matches the tag-triggered failure.

RED: After real libxev seeding into .zig-cache, the old offline consumer reported a missing package in .zig-global-cache, matching the earlier failure at the same pin.

GREEN: test\windows\zig-dependency-download.ps1 passes in PS5.1 and PS7 for lengthless/chunked/redirected responses, 404/truncated transfers, optional failures, partial cleanup, and cached-archive reuse. The downloader uses real loopback HTTP; the Zig handoff is isolated for these tests.

REGRESSION: All actual Windows dependency archives, including ImGui, seed successfully. The real offline Zig build consumes the seeded CI cache in both PowerShell engines. Same-drive, flagship verification, and normal PS7 source syntax/JSON checks pass locally.

Hosted Test 35284668591 passed attempt 1 at 2aadfe029e6404fe0edd06fa0a4c7d77954cf229:

• Windows Build And Tests: passed, including both reported failure points, both PowerShell regression variants, host ABI/lifecycle/input/renderer gates, formatting, full Zig tests, custom shaders, compositor tests, x64 build/version smoke, and ARM64 cross-build.
• Windows x64 Portable Package Smoke: passed.
• Windows 11 Interactive Composite: intentionally not selected on the topic-branch push.

No test threshold or existing job was weakened/skipped to obtain this result.

The PR-triggered hosted reruns also passed at the same head:

• Test 35286063522: Windows Build And Tests and Windows x64 Portable Package Smoke both succeeded. The overall run remains queued solely for the interactive job described below.
• Native Windows ARM64 35286063568: attempt 1 passed, including native Zig tests, ARM64 build/package, and both source/packaged CLI smoke checks.

Remaining boundaries

The fork currently has no registered self-hosted runners. Its existing same-repository PR trigger requests Windows 11 Interactive Composite, so that PR-only job cannot run until an owned runner is configured. The passing hosted push run above is not interactive Windows 11 evidence, and this PR does not alter that policy.

The protected graphcode-windows-baseline-2026-09-17 tag stays at f5abc059e4ca58b376eb209313aca7784659c679; its historical workflow failures remain historical. GraphCode's provider pin and pinned bootstrap checkout are unchanged. Adoption of a newer provider pin is separate from this CI repair.