fix(fetch): bound incomplete successful download attempts

[DivyamTalwar]

Summary

Fixes #11.

The attempt counter increases only on selected failures. A 200/206 that ends with insufficient or empty content can repeatedly issue GETs without consuming tries. Charge each issued GET once, preserving completion on the final allowed attempt and partial-file recovery.

Testing

Base: 252e5193902d466726da9af75047dfffff2ae662. Debian 12 Linux aarch64 in a nonroot disposable container, Python 3.11. The full existing smoke exits 0 with eight pre-existing optional research/hardware skips, explicitly not counted as passes. No Windows run or GPU/real-model benchmark is claimed.

The same final test files fail against unchanged production; the corrected branch gives:

Focused: 13 passed, 2 subtests passed in 0.16s
Full applicable suite: 8 SKIPPED (a skip is not a pass):
all green

python tests/smoke.py
ruff check quantprobe
ruff format --check quantprobe
# Bandit medium-severity checks on changed package modules
git diff --check

All applicable commands above exited 0 locally. The snapshot is a complete upstream checkout plus this branch's exact changed-file bytes; no test is a copied production-function reimplementation. External I/O is mocked where stated. Dependencies and lockfiles are unchanged.

Security And Data Access

No credential, production-data, authentication, read-only guardrail or privileged workflow changes are included. Tests use synthetic inputs and disposable paths. No new benchmark, fitted law, or hardware capability is claimed.

Notes

The count now limits requests rather than selected failures. More than 100 clean partial responses can require rerunning the command, with partial bytes retained. This is not a wall-clock deadline or unknown-length integrity fix. The existing-file skip fallback and standalone weights/hf_fetch.py are unchanged.

AI-assisted implementation, isolated same-provider source review, and controller regression checks are disclosed. They are not maintainer approval, cross-vendor certification, or hosted CI. One focused, signed-off commit; no generated logs, personal config, model weights or worktree state is included.

Draft pending upstream CI and maintainer review. Companion changes touching the same module/test hook may require rebasing as they land; no combined branch is being submitted.