feat(platform): add atomic HTTP download helper

internal/platform/download_test.go

@@ -0,0 +1,45 @@
+package platform
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestDownloadHappyPath(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("payload"))
+	}))
+	defer srv.Close()
+	dir := t.TempDir()
+	dest := filepath.Join(dir, "out.bin")
+	if err := Download(context.Background(), srv.URL, dest, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := os.ReadFile(dest)
+	if string(got) != "payload" {
+		t.Fatalf("got %q want payload", got)
+	}
+	info, _ := os.Stat(dest)
+	if info.Mode().Perm() != 0o755 {
+		t.Fatalf("mode=%v want 0755", info.Mode().Perm())
+	}
+}
+
+func TestDownload404Errors(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "nope", http.StatusNotFound)
+	}))
+	defer srv.Close()
+	dir := t.TempDir()
+	dest := filepath.Join(dir, "out.bin")
+	if err := Download(context.Background(), srv.URL, dest, 0o644); err == nil {
+		t.Fatal("want error on 404")
+	}
+	if _, err := os.Stat(dest); !os.IsNotExist(err) {
+		t.Fatal("dest should not exist after failed download")
+	}
+}