ci(docs): harden Natural Docs download with retries and zip validation

naturaldocs.org has been intermittently serving error pages to GitHub
runner IPs, silently writing a non-zip into nd.zip and failing the
deploy. Add curl --fail/--show-error with 5 retries (--retry-all-errors)
and a PK-magic-byte guard so a bad download fails loudly instead of
reaching unzip.

Author: fank

.github/workflows/docs.yml

@@ -30,7 +30,15 @@ jobs:
 
       - name: Install Natural Docs
         run: |
-          curl -sL "https://www.naturaldocs.org/download/natural_docs/2.4/Natural_Docs_2.4_Development_Release_2.Linux.x64.zip" -o nd.zip
+          curl -fsSL --retry 5 --retry-all-errors --retry-delay 5 \
+            "https://www.naturaldocs.org/download/natural_docs/2.4/Natural_Docs_2.4_Development_Release_2.Linux.x64.zip" \
+            -o nd.zip
+          # Guard against the server returning an error page (not a zip) or a truncated download.
+          if [ "$(head -c 2 nd.zip)" != "PK" ]; then
+            echo "::error::Natural Docs download is not a valid zip archive."
+            file nd.zip || true
+            exit 1
+          fi
           unzip -q nd.zip -d naturaldocs
           chmod +x "naturaldocs/Natural Docs/NaturalDocs"