Fix transient release downloads and bump v1.3.7

[Wibias]

Summary

Fix npx github-delivery update --apply failing immediately when a GitHub Release asset download hits a transient gateway error such as HTTP 504, and bump the package patch version to 1.3.7.

Root cause

The release client already bounded redirects, but its final asset request treated every non-2xx response as terminal. A single transient 502/503/504 from GitHub or its asset CDN therefore aborted the update before verification or apply.

Fix

• retry HTTP 502, 503, and 504 release-asset responses up to two times with bounded 250 ms / 750 ms delays
• discard the failed response body before retrying
• keep deterministic 4xx responses fail-fast
• preserve the existing HTTPS redirect, byte-limit, checksum/digest, tag/source-binding, and attestation verification path
• add regression coverage for transient recovery, retry-budget exhaustion, and non-retryable client errors
• bump package.json from 1.3.6 to 1.3.7

TDD evidence

The test-only head 79aa8d647f55c0b6924a7905184c512f47fc2e8a failed the canonical Node 24/Ubuntu repository check before the runtime implementation was added.

Scope

This PR contains the runtime fix, focused tests, and the package version bump only. Changelog/README release-preparation metadata can remain a separate release-prep step. No merge, tag, GitHub Release, npm publication, or other release publication is authorized by this PR.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2fe5d57a-6761-4800-b873-dbc5be2c92d0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}