0.4.49

feat(0.4.49): adaptive mirroring for github asset downloads (#317)

Plain github asset URLs with no explicit mirror config could hang for the
full timeout budget (600s x retries) on degraded networks ('connects,
then trickles') before any mirror was tried. Two changes fix the
experience with zero configuration:

- tinyhttps stall watchdog: abort an attempt whose windowed average speed
  stays below 10 KB/s over 15 s (curl --speed-limit style; pure
  StallDetector class, unit-tested) and move to the next candidate;
  per-read socket timeout lowered alongside so fully-silent connections
  fail fast too. Env: XLINGS_DOWNLOAD_LOW_SPEED=off|<bytes>:<secs>.
  Stalled attempts skip same-URL retries (each retry would burn another
  full window).
- mirror::adaptive: probe candidate hosts' TCP connect latency once per
  process (memoized, 1.5s cap) and order download candidates by latency.
  sha256 integrity gate: mirrors may be tried before the original URL
  only when the payload's bytes are pinned by a declared sha256;
  unpinned content keeps the author URL first unless its host is
  unreachable/penalized. Stalled hosts are penalized for the session.
  Env: XLINGS_ADAPTIVE_MIRROR=off.

Design: .agents/docs/2026-06-04-github-asset-adaptive-mirror.md