Add bounded timeouts and safe retry rules to release HTTP operations

[Exohayvan]

Summary

GitHub, Modrinth, and CurseForge publication requests use urllib.request.urlopen(...) without explicit timeouts.

Evidence

• common/scripts/publish_release.py:20-48 and package_release_target.py:38-54 call urlopen without a timeout.
• The local dependency downloader already uses bounded requests, showing the tooling has a precedent.
• Mutation requests cannot always be blindly retried because the remote outcome may be uncertain.

Impact

A stalled TLS connection or response can occupy a release runner until the much larger workflow timeout and leave publication state unclear.

Reproduction / verification

• Use a test endpoint that stalls during connect, response headers, and body transfer.
• Verify bounded failure and explicit reporting of whether a mutation may have reached the server.

Proposed direction

Add bounded connection/response deadlines, retry only safe idempotent reads automatically, and reconcile uncertain mutation outcomes before retrying.

Acceptance criteria

• Every outbound release HTTP operation has an explicit timeout.
• Retries cannot create duplicate releases/uploads.
• Timeout errors identify the operation and uncertainty state.
• Tests cover stalled reads and mutations.

Audit provenance

Candidate #30 from the read-only repository audit performed on 2026-07-20. This is separate from existing issues #3, #4, #25, and #27 unless explicitly linked later.