ci: retry tool downloads instead of piping curl into tar

e2e-test-zip failed on the first green deploy-beta in two months, six steps
before it ran anything:

  curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ...
  curl: (35) Recv failure: Connection reset by peer
  tar: Error is not recoverable: exiting now

Two problems. There was no retry, so one reset from get.nexte.st failed the
job. And piping into tar discarded curl's exit status — the default shell for
`run` is `bash -e`, without pipefail — so the diagnosis surfaced as a tar
error rather than the network failure it was.

Both downloads now retry and land in a file before extraction: cargo-nextest
in all five places it is installed (merge test, merge e2e-test-zip, merge
e2e-test-oci, pr, release) and mdBook in the docs workflow, which has the
same pattern and would have been the next one to flake.

Author: bnusunny

.github/workflows/docs.yaml

@@ -26,7 +26,10 @@ jobs:
       - name: Install mdBook
         run: |
           mkdir -p $HOME/bin
-          curl -sSL https://github.com/rust-lang/mdBook/releases/download/v0.4.40/mdbook-v0.4.40-x86_64-unknown-linux-gnu.tar.gz | tar -xz -C $HOME/bin
+          curl --retry 5 --retry-all-errors --retry-delay 5 -sSL \
+            https://github.com/rust-lang/mdBook/releases/download/v0.4.40/mdbook-v0.4.40-x86_64-unknown-linux-gnu.tar.gz \
+            -o /tmp/mdbook.tar.gz
+          tar -xz -C $HOME/bin -f /tmp/mdbook.tar.gz
           echo "$HOME/bin" >> $GITHUB_PATH
 
       - name: Build book

.github/workflows/merge.yaml

@@ -36,7 +36,13 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-nextest
-        run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
+        # Retried, and downloaded to a file rather than piped into tar: the default
+        # shell has no pipefail, so curl's exit status was discarded and a transient
+        # connection reset surfaced as an unrecoverable tar error.
+        run: |
+          curl --retry 5 --retry-all-errors --retry-delay 5 -LsSf \
+            https://get.nexte.st/latest/linux -o /tmp/cargo-nextest.tar.gz
+          tar zxf /tmp/cargo-nextest.tar.gz -C "${CARGO_HOME:-$HOME/.cargo}/bin"
 
       - name: linting
         run: |
@@ -271,7 +277,13 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-nextest
-        run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
+        # Retried, and downloaded to a file rather than piped into tar: the default
+        # shell has no pipefail, so curl's exit status was discarded and a transient
+        # connection reset surfaced as an unrecoverable tar error.
+        run: |
+          curl --retry 5 --retry-all-errors --retry-delay 5 -LsSf \
+            https://get.nexte.st/latest/linux -o /tmp/cargo-nextest.tar.gz
+          tar zxf /tmp/cargo-nextest.tar.gz -C "${CARGO_HOME:-$HOME/.cargo}/bin"
 
       - uses: actions/setup-python@v4
         with:
@@ -334,7 +346,13 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-nextest
-        run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
+        # Retried, and downloaded to a file rather than piped into tar: the default
+        # shell has no pipefail, so curl's exit status was discarded and a transient
+        # connection reset surfaced as an unrecoverable tar error.
+        run: |
+          curl --retry 5 --retry-all-errors --retry-delay 5 -LsSf \
+            https://get.nexte.st/latest/linux -o /tmp/cargo-nextest.tar.gz
+          tar zxf /tmp/cargo-nextest.tar.gz -C "${CARGO_HOME:-$HOME/.cargo}/bin"
 
       - uses: actions/setup-python@v4
         with:

.github/workflows/pr.yaml

@@ -28,7 +28,13 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-nextest
-        run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
+        # Retried, and downloaded to a file rather than piped into tar: the default
+        # shell has no pipefail, so curl's exit status was discarded and a transient
+        # connection reset surfaced as an unrecoverable tar error.
+        run: |
+          curl --retry 5 --retry-all-errors --retry-delay 5 -LsSf \
+            https://get.nexte.st/latest/linux -o /tmp/cargo-nextest.tar.gz
+          tar zxf /tmp/cargo-nextest.tar.gz -C "${CARGO_HOME:-$HOME/.cargo}/bin"
 
       - name: linting
         run: |

.github/workflows/release.yaml

@@ -32,7 +32,13 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Install cargo-nextest
-        run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ${CARGO_HOME:-~/.cargo}/bin
+        # Retried, and downloaded to a file rather than piped into tar: the default
+        # shell has no pipefail, so curl's exit status was discarded and a transient
+        # connection reset surfaced as an unrecoverable tar error.
+        run: |
+          curl --retry 5 --retry-all-errors --retry-delay 5 -LsSf \
+            https://get.nexte.st/latest/linux -o /tmp/cargo-nextest.tar.gz
+          tar zxf /tmp/cargo-nextest.tar.gz -C "${CARGO_HOME:-$HOME/.cargo}/bin"
 
       - name: linting
         run: |