Harden tests for remote-download paths (follow-up to #23709)

#23709 showed that downloads ignoring HTTP errors fail confusingly far from the cause. #23716 adds fail-fast guards for four such paths, with unit tests for two of them (ISO 404, release lookup 403).

Still missing, tracked here so it doesn't delay the gvisor fix:

• Runner-level test for the remote image-build curl change (pkg/minikube/cruntime/containerd.go): needs a fake command runner asserting -fSL is passed to curl.
• Provision test for the curl -fsSL change (pkg/libmachine/provision/utils.go): needs an SSH runner capturing the install command, asserting a bad response can't reach sh.
• Decision: pin https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4 to a tag or commit instead of tracking main.
• Optional: checksum and size-cap policy for tarballs fetched at runtime.

Rule going forward: every download-path fix lands with a test that fails on the old code first.