gh-48: Report slow downloads

[Punisheroot]

Summary

• report silent downloads once they have taken more than five seconds
• keep existing progress callbacks unchanged and avoid a duplicate warning when a progress display is already visible
• let the BITS, urllib, and PowerShell fallback paths recheck silent downloads while they are waiting

Rationale

PyManager intentionally does not announce every download because operations such as traversing a chain of index.json files would become noisy. However, a download that remains silent for several seconds can look as though the command has stalled.

Each network request now records a monotonic start time. Its shared progress handler emits one warning after five seconds only when the caller has not supplied a progress callback and the operation is not already complete. The request's existing string conversion sanitizes credentials before the URL is logged.

The check remains progress-driven, matching the existing delayed warnings in rmtree and unlink, and does not create a timer thread for every short-lived index request. Silent BITS jobs are checked during their existing polling loop, urllib requests recheck after connecting, and the PowerShell fallback polls once per second only when there is no visible progress callback. The existing ten-second PowerShell startup timeout is preserved.

Validation

• tests/test_urlutils.py -k slow_download_warning: 5 passed
• focused urllib paths and slow-download coverage: 6 passed
• PowerShell download paths: 2 passed
• tests/test_install_command.py -k download_package_yes_aborts_background_download: 1 passed
• git diff --check

The full native suite was not available locally because the installed interpreter does not match _native_test.cp314; the repository CI builds that module with its pinned Python 3.14.6 runtime.

Fixes #48