report failed downloads quietly when a fallback candidate succeeds

[kevinushey]

Closes #1727. Alternative to #2332.

Problem

When a binary package fails to download but the source fallback succeeds, users see an alarming ERROR line immediately followed by a successful download of the same package:

- Downloading bread 1.0.0 ...           	ERROR [error code 37]
- Downloading bread 1.0.0 ...           	OK [272 bytes]

Approach

No output capture is used at all (an earlier revision used capture.output(), but sink + textConnection is slow). Instead, download status reporting is routed through a small status slot:

• download()'s status messages (OK [...], ERROR [...]) are reported via a new renv_download_status() helper. By default it prints eagerly, preserving current behavior for all callers; when the$download_status is active, the message is stashed there instead, and the download preamble is not printed.
• renv_retrieve_package() gains a defer argument. When set, it activates the status slot around the download, then assembles preamble + status afterward: emitted on success, or attached to the error condition otherwise. The slot is cleared before dependency recursion, so recursive retrievals stream their output live as usual; a deferred cleanup acts as a backstop for non-local exits (e.g. interrupts).
• Only the repository candidate paths opt in (binary, source, Nexus fallbacks, P3M, archive). GitHub / GitLab / Bitbucket and tagged-record retrievals have no fallback candidates, and keep streaming output as before. defer is also disabled when renv.download.trace is enabled.
• If every candidate fails, the deferred status lines are replayed before the collected errors are reported, so no diagnostic output is lost.
• Errors signaled via renv.retrieve.error are now tagged, fixing two pre-existing duplicate reports: the candidate loop re-collecting errors already collected by the condition handler, and renv_retrieve_repos_archive() re-signaling errors already signaled by renv_retrieve_package().

Tests

• New test covering the quiet-fallback case: a repository advertising a binary package without its archive, plus a valid source tarball; asserts the ERROR line is suppressed and the successful OK line is still emitted.
• New test covering the all-fail case: asserts the failed download status lines are replayed and each failure is warned exactly once.
• devtools::test(filter = "retrieve"): 31 passed. Broader run over restore / install / download / repos / bioconductor / remotes: 345 passed.