Stability pass: deterministic dependency order, retry backoff, input validation

Found via manual audit plus a staticcheck run:

- collectDependencyClosure iterated a package's dependencies map
  directly, so which package "won" a same-key collision (and the
  order things got downloaded/unpacked in) could vary between runs
  of the exact same download command. Sort the dependency targets
  first, matching what --print-deps-tree's tree-printer already did.
  Verified two consecutive --print-deps-tree runs now produce
  byte-identical output.
- HTTP retry loops (manifest fetch, payload download) retried
  immediately with no backoff, which just hammers a server harder
  during exactly the kind of transient failure retries exist for.
  Added a capped exponential backoff (1s/2s/4s/8s/10s).
- --architecture/--host-arch accepted any string silently; a typo'd
  value matched nothing during package selection and surfaced as a
  confusing downstream failure far from the actual mistake. Now
  rejected up front with a clear error.
- pumpLines' bufio.Scanner silently stops (dropping the rest of a
  tool's output) if a single line ever exceeds its buffer - narrow but
  real for pathological cases like heavily templated C++ diagnostics.
  Now at least reports that truncation happened instead of losing
  output with no trace.
- Removed select.go's unused off() helper (staticcheck U1000).

Re-verified end-to-end after these changes: a real KMDF driver build
and a plain cl/link build both still succeed.

internal/download/fetch.go

@@ -84,6 +84,9 @@ func FetchPayloads(selected []*Package, cacheDir string, allowHashMismatch bool)
 func fetchOnePayloadWithRetries(payload Payload, dest, fileID string, allowHashMismatch bool) (int64, error) {
 	var lastErr error
 	for attempt := 0; attempt < maxDownloadAttempts; attempt++ {
+		if attempt > 0 {
+			time.Sleep(retryBackoff(attempt))
+		}
 		n, err := tryDownloadPayload(payload, dest, fileID, allowHashMismatch)
 		if err == nil {
 			return n, nil
@@ -94,6 +97,17 @@ func fetchOnePayloadWithRetries(payload Payload, dest, fileID string, allowHashM
 	return 0, fmt.Errorf("giving up on %s after %d attempts: %w", fileID, maxDownloadAttempts, lastErr)
 }
 
+// retryBackoff gives a transient failure (network blip, momentary rate
+// limiting) a little room to clear before hammering the same URL again:
+// 1s, 2s, 4s, 8s, capped at 10s.
+func retryBackoff(attempt int) time.Duration {
+	d := time.Second << uint(attempt-1)
+	if d > 10*time.Second {
+		d = 10 * time.Second
+	}
+	return d
+}
+
 func tryDownloadPayload(payload Payload, dest, fileID string, allowHashMismatch bool) (int64, error) {
 	if fi, err := os.Stat(dest); err == nil && fi.Mode().IsRegular() {
 		if payload.SHA256 != "" {