34fbf36610
14 pinning tests lock downloadAppUpdate's security invariants (redirect re-validation per hop, checksum refusal paths, SHA-256 verify + cleanup, truncation, idle-timeout, cancel in both phases, progress) with a scripted net.request fake; then the nested streaming block is extracted verbatim into streamInstallerToFile. downloadAppUpdate is now a linear pre-flight; B6 cancel-slot ownership stays with its module state via onCancelReady/onSettled. Pins green before and after. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>