Harden HTTP, dry-run, and command guardrails

[fullstackjam]

Summary

• route core HTTP round-trips through httputil.Do and support HTTP-date Retry-After values
• tighten the HTTP archtest to enforce raw round-trips instead of local request construction
• annotate dry-run baseline entries with audited exemptions vs remaining state-persistence debt
• add context-aware system/npm command paths and wire installer/update flows to cancellable timeouts

Tests

• go vet ./...
• go test ./internal/...