[FEAT cloudctl] - Add tool download infrastructure #71

User Story

As a cloudctl user, I want cloudctl to download and cache versioned tool binaries automatically, so I don't need to manage kubectl/helm/kubelogin versions manually.

Description

Port the full download package from u8s: generic file download with SHA-256 verification, tar.gz and zip extraction, GitHub Releases API digest support (preferred, with .sha256 URL fallback), progress output to stderr, and size caps (200 MiB download, 500 MiB extraction). This is the foundation for all tool subcommands.

Acceptance Criteria

• DownloadFile — single binary download with SHA-256 verification
• DownloadTarGzFile — tar.gz extraction with file filter and checksum
• DownloadZipFile — zip extraction with file filter and checksum
• DownloadGitHubReleaseBinary — GitHub release asset download with API digest preferred, .sha256 URL fallback
• Downloads cached in XDG cache dir under versioned filename; re-download skipped if already present
• Progress output to stderr; 200 MiB download cap and 500 MiB extraction cap enforced

Reference Issues

Epic: #70