fix: await progress-log writes before finishing CLI download

[EhabY]

What

Fixes a flaky test: redownloads when version mismatch is detected concurrently.

Root cause

performBinaryDownload writes the progress log two ways:

1. Fire-and-forget "downloading" writes from the onProgress callback (not awaited).
2. An awaited clearProgress in the finally block.

The final "downloading" write could land after clearProgress ran, re-creating .progress.log and leaving it behind. The ordering between the last writeStream.write callback and readStream.on("close") is non-deterministic, so the test's vi.waitFor occasionally timed out waiting for the file to disappear.

Fix

Track the latest progress write and await it before resolving or rejecting the download promise (on the success close path and the error paths), so clearProgress always runs after the final write.

Why this is safe

• The progress log is a plain fs.writeFile, no lock, rename, or ownership change. It never goes through renameWithRetry, so there is no Windows rename or backoff cost.
• The write is already .catch-wrapped and logged as a warning, so a slow or failing write never rejects the download.
• writeStream.close() flushes pending writes, firing the pending callback and resolving the tracked promise, so no deadlock.

Testing

• pnpm typecheck
• pnpm exec eslint src/core/cliManager.ts
• pnpm test:extension ./test/unit/core/cliManager.concurrent.test.ts ./test/unit/core/cliManager.test.ts (67 passing)

---

🤖 Generated by Coder Agents.