Make retired-artifact smoke portable to Bash 3

[yyods]

Summary

• reproduce the production deployment failure under macOS Bash 3 with a regression guard
• replace empty optional argument arrays with portable explicit curl --request GET|HEAD
• retain exact GET and HEAD 404/no-store verification for retired v0.4.1 firmware and unversioned social cards

Incident behavior

The first deployment of protected-main commit e56371384cfec28e12002a345ca8df0c0bbb5c5e reached post-activation smoke, then macOS Bash 3 raised retired_public_asset_curl_mode[@]: unbound variable. The activation trap restored /srv/pyble/releases/20260731T164104Z-88b649c03c8b; the source marker, Nginx configuration, v0.4.2 bytes, and public installer remained healthy.

Validation

• red regression: both retired-artifact contract checks fail against the array implementation
• green targeted deployment contract: 24 passed
• complete website gate: formatting, lint, typecheck, license audit, 174 tests, vinext compatibility, Next static build, and Sites build all pass
• bash -n tools/web/deploy/vps/deploy.sh: pass

No firmware bytes or release evidence changed.