fix(net): stop classifying casks from redirect chains the download would reject

[indaco]

Description

The HEAD walk that classifies a cask artifact resolved one redirect further
than the download could follow. A cask URL behind exactly that many redirects
classified successfully - possibly as .pkg, which raises the system-wide
sudo installer -target / prompt - and then always failed at download. No
install that works today changes; the password prompt just stops being raised
for a download that provably cannot complete.

The budgets disagreed because each of the three redirect walks kept its own
copy of the rules. They now share one decision, so this class of drift - four
instances so far - closes by construction rather than by hand.

Related Issue

• None

Notes for Reviewers

• The budget's value is untouched; it is deliberate stdlib parity.
• Three existing regression scripts asserted the old three-call-site shape and
  are re-pointed at the shared decision; their fixtures are unchanged.