diff --git a/.agents/agents/agent-analytics/agent.md b/.agents/agents/agent-analytics/agent.md
index 706adf444e..b80e39699e 100644
--- a/.agents/agents/agent-analytics/agent.md
+++ b/.agents/agents/agent-analytics/agent.md
@@ -21,15 +21,18 @@ STEP 0 — Check for and install the Go toolchain + uv if missing:
     # Check for Go toolchain — install only what is missing
     export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"
     if ! command -v go >/dev/null 2>&1; then
-      curl -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
+      echo "installing go 1.26.3"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
       sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
       export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"
     fi
     if ! command -v task >/dev/null 2>&1; then
-      go install github.com/go-task/task/v3/cmd/task@latest
+      echo "installing task"
+      timeout 600 go install github.com/go-task/task/v3/cmd/task@latest
     fi
     if ! command -v golangci-lint >/dev/null 2>&1; then
-      curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
+      echo "installing golangci-lint 2.12.2"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
       tar -C /tmp -xzf /tmp/gcl.tgz && sudo mv /tmp/golangci-lint-2.12.2-linux-amd64/golangci-lint /usr/local/bin/ && rm -rf /tmp/gcl.tgz /tmp/golangci-lint-2.12.2-linux-amd64
     fi
     # Check for uv — install only if missing (scripts declare deps inline via PEP 723)
diff --git a/.agents/agents/ci-optimizer/agent.md b/.agents/agents/ci-optimizer/agent.md
index 820749bea6..d8c315b7be 100644
--- a/.agents/agents/ci-optimizer/agent.md
+++ b/.agents/agents/ci-optimizer/agent.md
@@ -18,13 +18,15 @@ STEP 0 — Check for and install gh + act if missing (no Go needed; CI work is Y
     set -e
     # gh CLI (for listing/viewing workflow runs) — install only if missing
     if ! command -v gh >/dev/null 2>&1; then
-      curl -sSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
+      echo "installing gh"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
       echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null
       sudo apt-get update -qq && sudo apt-get install -y -qq gh
     fi
     # act (best-effort local workflow validation; .actrc exists). Docker may be unavailable — that's OK.
     if ! command -v act >/dev/null 2>&1; then
-      curl -sSL https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash -s -- -b /usr/local/bin || true
+      echo "installing act"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash -s -- -b /usr/local/bin || true
     fi
     command -v gh && (command -v act || echo "act unavailable — will validate via YAML parse")
 cd into the cloned devsy repo workspace
diff --git a/.agents/agents/cmd-reviewer/agent.md b/.agents/agents/cmd-reviewer/agent.md
index 92794ba0fa..069743e1a2 100644
--- a/.agents/agents/cmd-reviewer/agent.md
+++ b/.agents/agents/cmd-reviewer/agent.md
@@ -18,15 +18,18 @@ STEP 0 — Check for and install the Go toolchain if missing (Go, task, golangci
     # Check for Go toolchain — install only what is missing
     export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"
     if ! command -v go >/dev/null 2>&1; then
-      curl -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
+      echo "installing go 1.26.3"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
       sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
       export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"
     fi
     if ! command -v task >/dev/null 2>&1; then
-      go install github.com/go-task/task/v3/cmd/task@latest
+      echo "installing task"
+      timeout 600 go install github.com/go-task/task/v3/cmd/task@latest
     fi
     if ! command -v golangci-lint >/dev/null 2>&1; then
-      curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
+      echo "installing golangci-lint 2.12.2"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
       tar -C /tmp -xzf /tmp/gcl.tgz && sudo mv /tmp/golangci-lint-2.12.2-linux-amd64/golangci-lint /usr/local/bin/ && rm -rf /tmp/gcl.tgz /tmp/golangci-lint-2.12.2-linux-amd64
     fi
 go version && task --version && golangci-lint --version
diff --git a/.agents/agents/codefactor/agent.md b/.agents/agents/codefactor/agent.md
index a0fea84878..cde6c896ef 100644
--- a/.agents/agents/codefactor/agent.md
+++ b/.agents/agents/codefactor/agent.md
@@ -19,15 +19,18 @@ STEP 0 — Check for and install the Go toolchain if missing (Go, task, golangci
     # Check for Go toolchain — install only what is missing
     export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"
     if ! command -v go >/dev/null 2>&1; then
-      curl -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
+      echo "installing go 1.26.3"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
       sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
       export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"
     fi
     if ! command -v task >/dev/null 2>&1; then
-      go install github.com/go-task/task/v3/cmd/task@latest
+      echo "installing task"
+      timeout 600 go install github.com/go-task/task/v3/cmd/task@latest
     fi
     if ! command -v golangci-lint >/dev/null 2>&1; then
-      curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
+      echo "installing golangci-lint 2.12.2"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
       tar -C /tmp -xzf /tmp/gcl.tgz && sudo mv /tmp/golangci-lint-2.12.2-linux-amd64/golangci-lint /usr/local/bin/ && rm -rf /tmp/gcl.tgz /tmp/golangci-lint-2.12.2-linux-amd64
     fi
 go version && task --version && golangci-lint --version
diff --git a/.agents/agents/devcontainer-spec/agent.md b/.agents/agents/devcontainer-spec/agent.md
index d11d1f239e..010612af45 100644
--- a/.agents/agents/devcontainer-spec/agent.md
+++ b/.agents/agents/devcontainer-spec/agent.md
@@ -19,15 +19,18 @@ STEP 0 — Check for and install the Go toolchain + devcontainer CLI if missing:
     # Check for Go toolchain — install only what is missing
     export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"
     if ! command -v go >/dev/null 2>&1; then
-      curl -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
+      echo "installing go 1.26.3"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
       sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
       export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"
     fi
     if ! command -v task >/dev/null 2>&1; then
-      go install github.com/go-task/task/v3/cmd/task@latest
+      echo "installing task"
+      timeout 600 go install github.com/go-task/task/v3/cmd/task@latest
     fi
     if ! command -v golangci-lint >/dev/null 2>&1; then
-      curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
+      echo "installing golangci-lint 2.12.2"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
       tar -C /tmp -xzf /tmp/gcl.tgz && sudo mv /tmp/golangci-lint-2.12.2-linux-amd64/golangci-lint /usr/local/bin/ && rm -rf /tmp/gcl.tgz /tmp/golangci-lint-2.12.2-linux-amd64
     fi
     # Check for devcontainer CLI — install only if missing
diff --git a/.agents/agents/integration-test/agent.md b/.agents/agents/integration-test/agent.md
index b9510135e9..f17eaabfe3 100644
--- a/.agents/agents/integration-test/agent.md
+++ b/.agents/agents/integration-test/agent.md
@@ -18,15 +18,18 @@ STEP 0 — Check for and install the Go toolchain if missing (Ginkgo comes with
     # Check for Go toolchain — install only what is missing
     export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"
     if ! command -v go >/dev/null 2>&1; then
-      curl -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
+      echo "installing go 1.26.3"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
       sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
       export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"
     fi
     if ! command -v task >/dev/null 2>&1; then
-      go install github.com/go-task/task/v3/cmd/task@latest
+      echo "installing task"
+      timeout 600 go install github.com/go-task/task/v3/cmd/task@latest
     fi
     if ! command -v golangci-lint >/dev/null 2>&1; then
-      curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
+      echo "installing golangci-lint 2.12.2"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
       tar -C /tmp -xzf /tmp/gcl.tgz && sudo mv /tmp/golangci-lint-2.12.2-linux-amd64/golangci-lint /usr/local/bin/ && rm -rf /tmp/gcl.tgz /tmp/golangci-lint-2.12.2-linux-amd64
     fi
 go version && task --version && golangci-lint --version
diff --git a/.agents/agents/lint-fixer/agent.md b/.agents/agents/lint-fixer/agent.md
index 4d927327bd..d5db2feeee 100644
--- a/.agents/agents/lint-fixer/agent.md
+++ b/.agents/agents/lint-fixer/agent.md
@@ -20,20 +20,25 @@ STEP 0 — Check for and install the Go toolchain + Node if missing:
     # Check for Go toolchain — install only what is missing
     export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"
     if ! command -v go >/dev/null 2>&1; then
-      curl -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
+      echo "installing go 1.26.3"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
       sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
       export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"
     fi
     if ! command -v task >/dev/null 2>&1; then
-      go install github.com/go-task/task/v3/cmd/task@latest
+      echo "installing task"
+      timeout 600 go install github.com/go-task/task/v3/cmd/task@latest
     fi
     if ! command -v golangci-lint >/dev/null 2>&1; then
-      curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
+      echo "installing golangci-lint 2.12.2"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
       tar -C /tmp -xzf /tmp/gcl.tgz && sudo mv /tmp/golangci-lint-2.12.2-linux-amd64/golangci-lint /usr/local/bin/ && rm -rf /tmp/gcl.tgz /tmp/golangci-lint-2.12.2-linux-amd64
     fi
     # Check for Node — install only if missing
     if ! command -v node >/dev/null 2>&1; then
-      curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash - >/dev/null 2>&1 && sudo apt-get install -y -qq nodejs >/dev/null 2>&1 || true
+      echo "installing node via nodesource setup_24.x"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://deb.nodesource.com/setup_24.x -o /tmp/ns_setup.sh
+      sudo -E bash /tmp/ns_setup.sh >/dev/null 2>&1 && sudo apt-get install -y -qq nodejs >/dev/null 2>&1 || true
     fi
     go version && task --version && golangci-lint --version && node --version
 cd into the cloned devsy repo workspace and run: task cli:tidy
diff --git a/.agents/agents/pkg-container/agent.md b/.agents/agents/pkg-container/agent.md
index a730c6fdb1..b23137ef38 100644
--- a/.agents/agents/pkg-container/agent.md
+++ b/.agents/agents/pkg-container/agent.md
@@ -19,15 +19,18 @@ STEP 0 — Check for and install the Go toolchain if missing (Go, task, golangci
     # Check for Go toolchain — install only what is missing
     export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"
     if ! command -v go >/dev/null 2>&1; then
-      curl -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
+      echo "installing go 1.26.3"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
       sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
       export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"
     fi
     if ! command -v task >/dev/null 2>&1; then
-      go install github.com/go-task/task/v3/cmd/task@latest
+      echo "installing task"
+      timeout 600 go install github.com/go-task/task/v3/cmd/task@latest
     fi
     if ! command -v golangci-lint >/dev/null 2>&1; then
-      curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
+      echo "installing golangci-lint 2.12.2"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
       tar -C /tmp -xzf /tmp/gcl.tgz && sudo mv /tmp/golangci-lint-2.12.2-linux-amd64/golangci-lint /usr/local/bin/ && rm -rf /tmp/gcl.tgz /tmp/golangci-lint-2.12.2-linux-amd64
     fi
 go version && task --version && golangci-lint --version
diff --git a/.agents/agents/pkg-core-agent/agent.md b/.agents/agents/pkg-core-agent/agent.md
index e969258fcf..f15e07348f 100644
--- a/.agents/agents/pkg-core-agent/agent.md
+++ b/.agents/agents/pkg-core-agent/agent.md
@@ -19,15 +19,18 @@ STEP 0 — Check for and install the Go toolchain if missing (Go, task, golangci
     # Check for Go toolchain — install only what is missing
     export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"
     if ! command -v go >/dev/null 2>&1; then
-      curl -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
+      echo "installing go 1.26.3"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
       sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
       export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"
     fi
     if ! command -v task >/dev/null 2>&1; then
-      go install github.com/go-task/task/v3/cmd/task@latest
+      echo "installing task"
+      timeout 600 go install github.com/go-task/task/v3/cmd/task@latest
     fi
     if ! command -v golangci-lint >/dev/null 2>&1; then
-      curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
+      echo "installing golangci-lint 2.12.2"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
       tar -C /tmp -xzf /tmp/gcl.tgz && sudo mv /tmp/golangci-lint-2.12.2-linux-amd64/golangci-lint /usr/local/bin/ && rm -rf /tmp/gcl.tgz /tmp/golangci-lint-2.12.2-linux-amd64
     fi
 go version && task --version && golangci-lint --version
diff --git a/.agents/agents/pkg-ssh-git/agent.md b/.agents/agents/pkg-ssh-git/agent.md
index 51a1756afc..b5f42800d0 100644
--- a/.agents/agents/pkg-ssh-git/agent.md
+++ b/.agents/agents/pkg-ssh-git/agent.md
@@ -19,15 +19,18 @@ STEP 0 — Check for and install the Go toolchain if missing (Go, task, golangci
     # Check for Go toolchain — install only what is missing
     export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"
     if ! command -v go >/dev/null 2>&1; then
-      curl -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
+      echo "installing go 1.26.3"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
       sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
       export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"
     fi
     if ! command -v task >/dev/null 2>&1; then
-      go install github.com/go-task/task/v3/cmd/task@latest
+      echo "installing task"
+      timeout 600 go install github.com/go-task/task/v3/cmd/task@latest
     fi
     if ! command -v golangci-lint >/dev/null 2>&1; then
-      curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
+      echo "installing golangci-lint 2.12.2"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
       tar -C /tmp -xzf /tmp/gcl.tgz && sudo mv /tmp/golangci-lint-2.12.2-linux-amd64/golangci-lint /usr/local/bin/ && rm -rf /tmp/gcl.tgz /tmp/golangci-lint-2.12.2-linux-amd64
     fi
 go version && task --version && golangci-lint --version
diff --git a/.agents/agents/pkg-system-platform/agent.md b/.agents/agents/pkg-system-platform/agent.md
index eca22c8556..53998ae13a 100644
--- a/.agents/agents/pkg-system-platform/agent.md
+++ b/.agents/agents/pkg-system-platform/agent.md
@@ -25,15 +25,18 @@ STEP 0 — Check for and install the Go toolchain if missing (Go, task, golangci
     # Check for Go toolchain — install only what is missing
     export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"
     if ! command -v go >/dev/null 2>&1; then
-      curl -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
+      echo "installing go 1.26.3"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
       sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
       export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"
     fi
     if ! command -v task >/dev/null 2>&1; then
-      go install github.com/go-task/task/v3/cmd/task@latest
+      echo "installing task"
+      timeout 600 go install github.com/go-task/task/v3/cmd/task@latest
     fi
     if ! command -v golangci-lint >/dev/null 2>&1; then
-      curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
+      echo "installing golangci-lint 2.12.2"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
       tar -C /tmp -xzf /tmp/gcl.tgz && sudo mv /tmp/golangci-lint-2.12.2-linux-amd64/golangci-lint /usr/local/bin/ && rm -rf /tmp/gcl.tgz /tmp/golangci-lint-2.12.2-linux-amd64
     fi
 go version && task --version && golangci-lint --version
diff --git a/.agents/agents/pkg-tunnel-network/agent.md b/.agents/agents/pkg-tunnel-network/agent.md
index 8108f9d05b..114ae64d7e 100644
--- a/.agents/agents/pkg-tunnel-network/agent.md
+++ b/.agents/agents/pkg-tunnel-network/agent.md
@@ -19,15 +19,18 @@ STEP 0 — Check for and install the Go toolchain + protoc if missing:
     # Check for Go toolchain — install only what is missing
     export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"
     if ! command -v go >/dev/null 2>&1; then
-      curl -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
+      echo "installing go 1.26.3"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
       sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
       export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"
     fi
     if ! command -v task >/dev/null 2>&1; then
-      go install github.com/go-task/task/v3/cmd/task@latest
+      echo "installing task"
+      timeout 600 go install github.com/go-task/task/v3/cmd/task@latest
     fi
     if ! command -v golangci-lint >/dev/null 2>&1; then
-      curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
+      echo "installing golangci-lint 2.12.2"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
       tar -C /tmp -xzf /tmp/gcl.tgz && sudo mv /tmp/golangci-lint-2.12.2-linux-amd64/golangci-lint /usr/local/bin/ && rm -rf /tmp/gcl.tgz /tmp/golangci-lint-2.12.2-linux-amd64
     fi
     # Check for protoc — install only if missing
diff --git a/.agents/agents/ui-polish/agent.md b/.agents/agents/ui-polish/agent.md
index 97474f80f6..d0a6cf859e 100644
--- a/.agents/agents/ui-polish/agent.md
+++ b/.agents/agents/ui-polish/agent.md
@@ -21,20 +21,25 @@ STEP 0 — Check for and install the Go + Node toolchain if missing:
     # Check for Go toolchain — install only what is missing
     export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"
     if ! command -v go >/dev/null 2>&1; then
-      curl -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
+      echo "installing go 1.26.3"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://go.dev/dl/go1.26.3.linux-amd64.tar.gz -o /tmp/go.tgz
       sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
       export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"
     fi
     if ! command -v task >/dev/null 2>&1; then
-      go install github.com/go-task/task/v3/cmd/task@latest
+      echo "installing task"
+      timeout 600 go install github.com/go-task/task/v3/cmd/task@latest
     fi
     if ! command -v golangci-lint >/dev/null 2>&1; then
-      curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
+      echo "installing golangci-lint 2.12.2"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://github.com/golangci/golangci-lint/releases/download/v2.12.2/golangci-lint-2.12.2-linux-amd64.tar.gz -o /tmp/gcl.tgz
       tar -C /tmp -xzf /tmp/gcl.tgz && sudo mv /tmp/golangci-lint-2.12.2-linux-amd64/golangci-lint /usr/local/bin/ && rm -rf /tmp/gcl.tgz /tmp/golangci-lint-2.12.2-linux-amd64
     fi
     # Check for Node — install only if missing
     if ! command -v node >/dev/null 2>&1; then
-      curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash - >/dev/null 2>&1 && sudo apt-get install -y -qq nodejs >/dev/null 2>&1 || true
+      echo "installing node via nodesource setup_24.x"
+      curl --retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL https://deb.nodesource.com/setup_24.x -o /tmp/ns_setup.sh
+      sudo -E bash /tmp/ns_setup.sh >/dev/null 2>&1 && sudo apt-get install -y -qq nodejs >/dev/null 2>&1 || true
     fi
     go version && task --version && golangci-lint --version && node --version
 cd into the cloned devsy repo workspace and run: task cli:tidy
diff --git a/hack/automations/main.go b/hack/automations/main.go
index 4554677f12..0328533b93 100644
--- a/hack/automations/main.go
+++ b/hack/automations/main.go
@@ -23,10 +23,11 @@ const (
 	golangciArchive  = "golangci-lint-" + golangciVersion + "-linux-amd64.tar.gz"
 	golangciDownload = "https://github.com/golangci/golangci-lint/releases/download/v" +
 		golangciVersion + "/" + golangciArchive
-	goTaskInstall = "go install github.com/go-task/task/v3/cmd/task@latest"
+	goTaskInstall = "timeout 600 go install github.com/go-task/task/v3/cmd/task@latest"
 	goVerify      = "go version && task --version && golangci-lint --version"
 	cdTidy        = "cd into the cloned devsy repo workspace and run: task cli:tidy"
 	cdPlain       = "cd into the cloned devsy repo workspace"
+	curlFlags     = "--retry 3 --retry-delay 5 --connect-timeout 30 --max-time 300 -sSL"
 )
 
 type agent struct {
@@ -223,15 +224,18 @@ func goInstallBlock() string {
 		"    # Check for Go toolchain — install only what is missing",
 		`    export PATH="/usr/local/go/bin:$(go env GOPATH 2>/dev/null)/bin:$PATH"`,
 		"    if ! command -v go >/dev/null 2>&1; then",
-		"      curl -sSL "+goDownloadURL+" -o /tmp/go.tgz",
+		`      echo "installing go `+goVersion+`"`,
+		"      curl "+curlFlags+" "+goDownloadURL+" -o /tmp/go.tgz",
 		"      sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz",
 		`      export PATH="/usr/local/go/bin:$(go env GOPATH)/bin:$PATH"`,
 		"    fi",
 		"    if ! command -v task >/dev/null 2>&1; then",
+		`      echo "installing task"`,
 		"      "+goTaskInstall,
 		"    fi",
 		"    if ! command -v golangci-lint >/dev/null 2>&1; then",
-		"      curl -sSL "+golangciDownload+" -o /tmp/gcl.tgz",
+		`      echo "installing golangci-lint `+golangciVersion+`"`,
+		"      curl "+curlFlags+" "+golangciDownload+" -o /tmp/gcl.tgz",
 		"      "+golangciExtract,
 		"    fi",
 	)
@@ -241,8 +245,10 @@ func nodeInstallBlock() string {
 	return joinLines(
 		"    # Check for Node — install only if missing",
 		"    if ! command -v node >/dev/null 2>&1; then",
-		"      curl -fsSL https://deb.nodesource.com/setup_24.x | "+
-			"sudo -E bash - >/dev/null 2>&1 && sudo apt-get install -y -qq nodejs >/dev/null 2>&1 || true",
+		`      echo "installing node via nodesource setup_24.x"`,
+		"      curl "+curlFlags+" https://deb.nodesource.com/setup_24.x -o /tmp/ns_setup.sh",
+		"      sudo -E bash /tmp/ns_setup.sh >/dev/null 2>&1 && "+
+			"sudo apt-get install -y -qq nodejs >/dev/null 2>&1 || true",
 		"    fi",
 	)
 }
@@ -292,7 +298,8 @@ func ghActBlock() string {
 	return joinLines(
 		"    # gh CLI (for listing/viewing workflow runs) — install only if missing",
 		"    if ! command -v gh >/dev/null 2>&1; then",
-		"      curl -sSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | "+
+		`      echo "installing gh"`,
+		"      curl "+curlFlags+" https://cli.github.com/packages/githubcli-archive-keyring.gpg | "+
 			"sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg",
 		`      echo "deb [arch=$(dpkg --print-architecture) `+
 			`signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] `+
@@ -303,7 +310,8 @@ func ghActBlock() string {
 		"    # act (best-effort local workflow validation; .actrc exists). "+
 			"Docker may be unavailable — that's OK.",
 		"    if ! command -v act >/dev/null 2>&1; then",
-		"      curl -sSL https://raw.githubusercontent.com/nektos/act/master/install.sh | "+
+		`      echo "installing act"`,
+		"      curl "+curlFlags+" https://raw.githubusercontent.com/nektos/act/master/install.sh | "+
 			"sudo bash -s -- -b /usr/local/bin || true",
 		"    fi",
 	)
diff --git a/hack/automations/main_test.go b/hack/automations/main_test.go
index ee14418b4f..3ef441fd2a 100644
--- a/hack/automations/main_test.go
+++ b/hack/automations/main_test.go
@@ -116,3 +116,33 @@ func TestToolchainPins(t *testing.T) {
 		t.Errorf("ci-optimizer: should not install Go toolchain (toolchain=gh+act)")
 	}
 }
+
+func TestToolchainDownloadsAreBounded(t *testing.T) {
+	runGenerator(t)
+	for _, id := range []string{"ui-polish", "pkg-container", "agent-analytics"} {
+		p := agentFilePath(t, id)
+		b, err := os.ReadFile(p)
+		if err != nil {
+			continue
+		}
+		s := string(b)
+		if !strings.Contains(s, "STEP 0") {
+			continue
+		}
+		for _, bad := range []string{
+			"curl -sSL https://go.dev/dl",
+			"curl -fsSL https://deb.nodesource.com",
+			"curl -sSL https://github.com/golangci",
+		} {
+			if strings.Contains(s, bad) {
+				t.Errorf("%s: unbounded curl download remains: %q", id, bad)
+			}
+		}
+		if !strings.Contains(s, "--max-time 300") {
+			t.Errorf("%s: curl downloads must set --max-time", id)
+		}
+		if !strings.Contains(s, "echo \"installing go 1.26.3\"") {
+			t.Errorf("%s: go install must echo progress for observability", id)
+		}
+	}
+}