Fix Linux Clippy imports and bound macOS zlib fetch retries

[debpalash]

Summary

• Gate macOS-only application-menu imports and qualify the macOS-only test type so Linux Clippy can keep enforcing -D warnings.
• Prefetch only the pinned Ghostty zlib package before the macOS workspace checks. Zig continues validating the manifest hash.
• Retry only the observed HTTP response read failure: Timeout, at most three attempts. Hash mismatches, mixed errors, and other failures remain fatal.

This addresses the Linux unused-import failures and macOS zlib-fetch timeout in baseline CI. The existing fmt, test, Clippy, license, offline release-build, and packaging gates are unchanged. There are no application trust, process-lifetime, or protocol changes.

Validation

Passed locally:

• Node tests: 55/55.
• Python tests: 12/12.
• Shell fault-injection checks: 10/10, including timeout recovery/exhaustion, hash mismatch, mixed errors, and large error logs.
• git diff --check.

Native Rust/Zig compilation and platform packaging have not run locally. This draft is for native macOS/Linux CI validation before review or merge.