fix(downloads): widen retry exception guard to include SSL/AuthenticationException

Author: NeuralFault

StabilityMatrix.Core/Models/TrackedDownload.cs

@@ -1,4 +1,5 @@
 using System.Diagnostics.CodeAnalysis;
+using System.Security.Authentication;
 using System.Text.Json.Serialization;
 using AsyncAwaitBestPractices;
 using NLog;
@@ -316,6 +317,15 @@ private void DoCleanup()
         }
     }
 
+    /// <summary>
+    /// Returns true for transient network/SSL exceptions that are safe to retry.
+    /// </summary>
+    private static bool IsTransientNetworkException(Exception? ex) =>
+        ex is IOException or AuthenticationException
+        || ex?.InnerException is IOException or AuthenticationException
+        || ex is AggregateException ae
+            && ae.InnerExceptions.Any(e => e is IOException or AuthenticationException);
+
     /// <summary>
     /// Invoked by the task's completion callback
     /// </summary>
@@ -349,7 +359,7 @@ private void OnDownloadTaskCompleted(Task task)
             // Set the exception
             Exception = task.Exception;
 
-            if ((Exception is IOException || Exception?.InnerException is IOException) && attempts < 3)
+            if (IsTransientNetworkException(Exception) && attempts < 3)
             {
                 attempts++;
                 Logger.Warn(