Studio: harden tokenless release redirect fallback (PR #5886)

Implement the hardening the added tests cover:

- Guard the redirect-resolved tag with is_release_tag_like so an unexpected
  redirect target fails closed to the REST/source path instead of building a
  404-bound download URL.
- When the REST listing and the redirect both fail, raise a chained error that
  names both causes instead of only the REST 403.
- Drop a no-op except branch in the specific-tag path and clarify the
  synthetic-release comment.
- Unpack the (requested_tag, plans) return in the asset-precedence test.

studio/install_llama_prebuilt.py

@@ -1169,7 +1169,10 @@ def _resolve_latest_release_tag_via_redirect(repo: str) -> str | None:
                     location = exc.headers.get("Location") if exc.headers else None
                 else:
                     raise
-            return _tag_from_release_location(location)
+            tag = _tag_from_release_location(location)
+            # Accept only upstream-style tags (b1234); any other redirect target
+            # is unexpected, so fail closed to the REST/source path.
+            return tag if is_release_tag_like(tag) else None
         except Exception as exc:
             last_exc = exc
             if attempt >= JSON_FETCH_ATTEMPTS or not is_retryable_url_error(exc):
@@ -1258,14 +1261,12 @@ def iter_release_payloads_by_time(
                 )
             else:
                 raise
-        except Exception:
-            raise
 
     # Primary: the GitHub REST release listing. Fallback for upstream "latest":
     # resolve the tag from the github.com release redirect (no api.github.com
-    # budget spent) and synthesize a release with deterministic asset URLs, so a
-    # rate-limited (HTTP 403) REST API does not force a source build. Gated to
-    # upstream single-asset platforms.
+    # budget spent) and synthesize a release whose sentinel lets the planner
+    # build deterministic download URLs, so a rate-limited (HTTP 403) REST API
+    # does not force a source build. Gated to upstream single-asset platforms.
     redirect_eligible = (
         repo == UPSTREAM_REPO
         and (not requested_tag or requested_tag == "latest")
@@ -1295,6 +1296,10 @@ def iter_release_payloads_by_time(
                     "_unsloth_download_repo": repo,
                 }
                 return
+            # Both REST and the redirect fallback failed; surface both causes.
+            raise RuntimeError(
+                f"{exc}; release redirect fallback for {repo} also failed"
+            ) from exc
         raise
     releases.sort(key = release_time_sort_key, reverse = True)
     for release in releases:

tests/studio/install/test_tokenless_release_resolution.py

@@ -418,7 +418,7 @@ def test_direct_release_real_asset_takes_precedence_over_redirect(monkeypatch):
         "_resolve_latest_release_tag_via_redirect",
         lambda repo: (_ for _ in ()).throw(AssertionError("redirect used")),
     )
-    plans = MOD.resolve_simple_install_release_plans(
+    _requested, plans = MOD.resolve_simple_install_release_plans(
         "latest", host, "ggml-org/llama.cpp", ""
     )
     assert plans