GHCR 307 strips Authorization

Trap: letting fetch automatically follow GHCR blob redirects looks correct, but ghcr.io returns HTTP 307 to Azure Blob Storage and forwarding Authorization causes Azure to return 404 while leaking registry credentials cross-origin. Fix: follow the redirect manually without the authorization header, preserve arbitrary external abort reasons structurally, and reject malformed or unexpected redirect targets.