Add wget/curl fallback for vendor and update downloads

scripts/fetch-vendor.sh

@@ -18,9 +18,23 @@ need_cmd() {
     command -v "$1" >/dev/null 2>&1 || { echo "ERROR: required command not found: $1" >&2; exit 1; }
 }
 
-need_cmd wget
 need_cmd sha256sum
 
+download_to() {
+    url="$1"
+    out="$2"
+    if command -v wget >/dev/null 2>&1; then
+        wget -O "$out" "$url"
+        return 0
+    fi
+    if command -v curl >/dev/null 2>&1; then
+        curl -fsSL "$url" -o "$out"
+        return 0
+    fi
+    echo "ERROR: required command not found: wget or curl" >&2
+    exit 1
+}
+
 fetch_one() {
     name="$1"
     url="$2"
@@ -35,7 +49,7 @@ fetch_one() {
     tmp="$dst.tmp"
 
     echo "[vendor] downloading $name"
-    wget -O "$tmp" "$url"
+    download_to "$url" "$tmp"
 
     got=$(sha256sum "$tmp" | awk '{print $1}')
     want=$(echo "$sha" | tr '[:upper:]' '[:lower:]')