Validate and retry manifest fetch to prevent silent failures

[priyagupta108]

Description:
This PR validates that the manifest is a non-empty list of valid releases, retries transient failures like truncated responses with backoff (skipping rate limits), and fails loudly when all sources are exhausted instead of silently exiting 0.

Related issue:
#1318

Check list:

• Mark if documentation changes are required.
• Mark if tests were added or updated to cover the changes.

[Copilot]

Pull request overview

This PR hardens Python versions manifest retrieval by validating manifest shape/content, adding bounded retries with exponential backoff for transient failures, skipping retries on rate-limit responses, and surfacing a hard failure when both manifest sources are exhausted (instead of silently succeeding).

Changes:

• Add manifest validation (non-empty list of IToolRelease) and a shared retry/backoff fetch helper.
• Skip retry/backoff when errors indicate rate limiting (HTTP 403/429), falling back to the alternate source immediately.
• Expand unit tests to cover fallback behavior, retries, rate-limit short-circuiting, and “fail loudly” behavior when all sources return invalid/empty manifests.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/install-python.ts	Introduces manifest validation plus retry/backoff logic and loud failure when both sources fail.
dist/setup/index.js	Updates the bundled distribution output to reflect the new manifest fetch/validation logic.
tests/install-python.test.ts	Adds/updates tests for retry, fallback, rate-limit behavior, and exhausted-source failure.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.