distribution: download-update copy loop has no stall/total timeout (root cause of every product's private watchdog) #253

download-update's copy loop waits on read-bytes-avail! with no timeout. At least two products carry byte-identical private watchdogs around it with comments documenting exactly this failure ("rivet's copy loop waits on read-bytes-avail! with no timeout… visibly stuck at 100%") — payback app/updater.rkt and brainfuel racket/brainfuel/updater.rkt, ~30 lines each, plus threadly/movebit variants.

#249 covers the fetch/check leg; this is the download leg's stall/total bound. Proposal: a stall deadline (no bytes for N seconds → retryable error) and an optional total cap inside download-update, parameterizable. Deletes one private watchdog per product and fixes the failure mode for products that haven't written one yet.