security: enforce HTTPS-only redirects in staging deploy script curl downloads

[Copilot]

curl -fsSL in the staging bootstrap script follows redirects without protocol restriction, allowing a potential downgrade from HTTPS to HTTP mid-redirect (SonarCloud shell:S6506, lines 144 and 162).

Changes

• scripts/STAGING_FIRST_DEPLOY.sh — both binary download calls (sops, age) hardened:
  • Replace -fsSL shorthand with explicit --fail --show-error --silent --location --proto '=https' --tlsv1.2
  • --proto '=https' blocks any redirect that would leave HTTPS
  • --tlsv1.2 enforces minimum TLS version on the connection
  • Inline comments added so intent is clear to future reviewers

# Before
curl -fsSL "https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/..." \
  -o /usr/local/bin/sops

# After
# Public GitHub release URL — enforce HTTPS-only redirects to prevent protocol downgrade.
curl --fail --show-error --silent --location --proto '=https' --tlsv1.2 \
  "https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/..." \
  -o /usr/local/bin/sops

Both download targets are public GitHub release endpoints; no local/internal HTTP checks are present in this script, so --proto '=https' is the correct and complete remedy for both hotspots.