fix: resolve GitHub release asset API URL for private repo bundle downloads

[lselvar]

Summary

• Extends the private-repo GitHub release asset fix from fix: resolve GitHub release asset API URL for private repo extension downloads #2792 (extensions) and fix: resolve GitHub release asset API URL for private repo preset and workflow downloads #2855 (presets/workflows) to cover bundle manifest downloads
• For private/SSO repos, browser release URLs (https://github.com/<owner>/<repo>/releases/download/<tag>/<asset>) redirect to an HTML/SSO page instead of the asset, causing bundle install / bundle info to fail when the catalog's download_url points at such a URL
• Applies resolve_github_release_asset_api_url (already in _github_http.py) in _download_remote_manifest before the HTTP download

Fix — one download path is now covered

_download_remote_manifest (catalog-based bundle manifest download):

• Resolves browser release URLs to REST API asset URLs before downloading the bundle manifest (YAML or ZIP)
• Direct REST API asset URLs (api.github.com/repos/.../releases/assets/<id>) are passed through directly with Accept: application/octet-stream
• The original catalog URL is still used to determine artifact format (.zip vs YAML) since the resolved API URL does not carry the file extension
• Other URLs: existing behavior unchanged

Implementation

Uses the existing shared resolve_github_release_asset_api_url(download_url, open_url_fn, timeout) function from _github_http.py — the same utility used by the extension, preset, and workflow fixes. No new helpers needed.

Test plan

• Run the bundler contract test suite:

  UV_NATIVE_TLS=true SSL_CERT_FILE=/opt/homebrew/etc/openssl@3/cert.pem UV_DEFAULT_INDEX=https://pypi.org/simple PYTHONPATH=src uv run --extra test pytest tests/contract/test_bundle_cli.py -v

  Expected: 25 passed (includes 2 new tests)
• Run full bundler test suite:

  UV_NATIVE_TLS=true SSL_CERT_FILE=/opt/homebrew/etc/openssl@3/cert.pem UV_DEFAULT_INDEX=https://pypi.org/simple PYTHONPATH=src uv run --extra test pytest tests/contract/ tests/unit/ tests/integration/ tests/test_github_http.py

  Expected: all passing
• Verify specify bundle install <id> works when the catalog's download_url points at a GitHub release asset on a private repo
• Verify specify bundle info <id> works for the same case

AI disclosure: This PR was developed with Claude Code assistance.

🤖 Generated with Claude Code