fix: decouple public fallback probe from R2

[tazarov]

Summary

• probe a deliberately missing release tag on the public fallback host
• keep the explicit 404 proof before exercising the built-in GitHub fallback
• avoid coupling fallback validation to the primary download hostname routing

Validation

• public bootstrap wrapper behavior tests passed
• public validation contract tests passed
• live missing-path probes returned 404 for checksum and artifact URLs
• the full v0.1.7 fallback wrapper passed locally with no library override

The immutable v0.1.7 tag and published assets are unchanged.

[github-actions]

PR Benchmark - no regressions

Threshold: >= 5.00% slower and p < 0.050.

This check is advisory; the PR is not blocked.