- dl_content no longer runs with no timeout at all: every attempt carries
--connect-timeout, and a content transfer that connects then crawls below
1 KiB/s for 30s is aborted so the next try can take over (a slow but moving
download is still never cut off by a total cap)
- verify the release binary by looking up its SHA256SUMS entry explicitly
instead of `sha256sum -c --ignore-missing`, which quietly succeeded when the
manifest held no line for the arch
- copy the local vps-prebuild instead of moving it, so a later failure cannot
destroy the only snapshot along with the temp dir
- fail loudly when lib-download.sh is missing instead of degrading silently
- drop the unused dl_handshake helper, accept binary-mode `*asset` lines, and
lower-case v4_forward in 30-haproxy so True/TRUE match like 00-ip-ask