fix: harden update compatibility gates

[Wangnov]

Summary

• retry Windows curl downloads with a legacy silent mode when older curl rejects --no-progress-meter
• raise the macOS process file descriptor soft limit before Gatekeeper assessment
• report Gatekeeper Too many open files as an assessment resource failure instead of a bundle rejection

Tests

• npm run build
• npm run test
• cargo clippy --manifest-path src-tauri/Cargo.toml --workspace --all-targets -- -D warnings
• cargo test --manifest-path src-tauri/Cargo.toml --workspace
• cargo test --manifest-path crates/codex-mac-engine/Cargo.toml --locked
• cargo test --manifest-path crates/codex-win-engine/Cargo.toml --locked
• codex review --uncommitted