fix(npm): release HTTPS response stream in postinstall downloadFile (gh#3595)

On Windows, `npm install -g @gastown/gt` fails during the postinstall
ZIP extraction with "The process cannot access the file ... because it
is being used by another process." PowerShell's Expand-Archive cannot
open the ZIP because Node.js still holds a handle to it.

Root cause: downloadFile() pipes the HTTPS response into a write stream
and resolves after file.close(), but never destroys the response. The
readable stream keeps the file handle alive until GC, and Windows
mandatory file locking prevents any other process from opening it in
the meantime. Unix uses advisory locking, so macOS/Linux are unaffected.

Fix: call response.destroy() immediately before resolving on the
success path. The redirect path already cleans up (resume + file.close
+ recurse) and is unchanged.

Closes gh#3595

Refs: hq-j6hur.6

Author: slit

npm-package/scripts/postinstall.js

@@ -83,8 +83,15 @@ function downloadFile(url, dest) {
 
       file.on('finish', () => {
         file.close((err) => {
-          if (err) reject(err);
-          else resolve();
+          if (err) {
+            reject(err);
+            return;
+          }
+          // On Windows, the HTTPS response stream still holds a file handle
+          // lock after the write stream closes. If we don't destroy it here,
+          // PowerShell's Expand-Archive can't open the ZIP for extraction.
+          response.destroy();
+          resolve();
         });
       });
     });