Use tracked environment package URLs

[d42me]

Switch environment package downloads to prefer tracked_package_url while falling back to package_url for compatibility, and follow redirects when streaming package archives.

---

Note

Medium Risk
Changes environment archive download behavior in both the CLI and Lab cache by switching URL selection and enabling redirects, which could affect how/where packages are fetched. Scope is limited to download paths and covered by updated tests.

Overview
Environment downloads now prefer tracked URLs. Archive fetches for prime env pull, private env build/pull, and Lab’s source cache use a shared _environment_package_download_url() helper that selects tracked_package_url first and falls back to package_url for compatibility.

HTTP streaming follows redirects. All httpx.stream calls that download environment tarballs now set follow_redirects=True, with tests updated/added to assert tracked-URL preference and redirect-following behavior.

^{Reviewed by Cursor Bugbot for commit a422cac. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9466c3ac37

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f7dbb09. Configure here.}