fix: use curl (not GIO File.copy) for remote .usmr downloads — GIO's synchronous TLS deadlocks on some servers

src/cli/Deploy.vala

@@ -564,7 +564,10 @@ private int deploy_provision_repositories(Vector<string> overrides, string conte
                 var local = Path.build_filename(destination, filename);
                 try {
                     printerr(@"Downloading repository descriptor from \"$path\"...\n");
-                    File.new_for_uri(path).copy(File.new_for_path(local), FileCopyFlags.OVERWRITE);
+                    var download = new Subprocess.newv(
+                        new string[] { "curl", "-fsSL", "--max-time", "30", "-o", local, path },
+                        SubprocessFlags.INHERIT_FDS);
+                    download.wait_check();
                 }
                 catch(Error e) {
                     printerr(@"Failed to download repository from \"$path\": $(e.message)\n");