fix: harden scaffold download safety

[heznpc]

Summary

• Applies the verified security/hardening fix for this repository's touched surface.
• Keeps the change scoped to the audited issue family and avoids unrelated cleanup.
• Leaves out preserved local-only work that belongs to a separate decision.

Local Verification

• Repo-specific lint/test/build/package checks were run before commit where applicable.
• Staged whitespace checks passed before commit.
• CI on this PR is the merge gate.