Use tracked environment package URLs

[d42me]

Switch environment package downloads to prefer tracked_package_url while falling back to package_url for compatibility, and follow redirects when streaming package archives.

---

Note

Medium Risk
Changes how environment source archives are fetched in both the CLI and Lab cache; incorrect URL selection or redirect handling could break pulls/installs for some environments, but the change is small and covered by tests.

Overview
Environment package downloads now prefer tracked_package_url over package_url (with a compatibility fallback) via a shared helper _environment_package_download_url used by prime env pull, private-env pull/build, and Lab’s environment source cache.

All archive downloads done via httpx.stream now enable follow_redirects=True, and tests were added/updated to assert tracked-URL preference and redirect-following behavior.

^{Reviewed by Cursor Bugbot for commit 6e9eb64. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9466c3ac37

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f7dbb09. Configure here.}