fix: add User-Agent header to _download in install_tools

dl.gitea.com returns 403 to Python's default urllib User-Agent,
causing Docker image builds to fail when installing tea CLI.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

src/devx/tools/install_tools.py

@@ -65,8 +65,13 @@ def _ensure_target_dir() -> Path:
 
 
 def _download(url: str, dest: Path) -> None:
-    """Download a file from ``url`` to ``dest`` with a 60s timeout."""
+    """Download a file from ``url`` to ``dest`` with a 60s timeout.
-    with urllib.request.urlopen(url, timeout=60) as resp, open(dest, "wb") as f:  # nosec B310
+
+    A User-Agent header is set because some CDNs (e.g. dl.gitea.com)
+    return 403 to requests with Python's default User-Agent.
+    """
+    req = urllib.request.Request(url, headers={"User-Agent": "devx/install-tools"})
+    with urllib.request.urlopen(req, timeout=60) as resp, open(dest, "wb") as f:  # nosec B310
         shutil.copyfileobj(resp, f)
 
 

tests/unit/test_install_tools.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import platform
+import urllib.request
 from pathlib import Path
 from unittest.mock import patch
 
@@ -66,6 +67,10 @@ class TestDownload:
         with patch("urllib.request.urlopen", return_value=_FakeResponse()) as mock_urlopen:
             install_tools._download("https://example.com/file", dest)
         mock_urlopen.assert_called_once()
+        call_args = mock_urlopen.call_args
+        req = call_args.args[0]
+        assert isinstance(req, urllib.request.Request)
+        assert req.get_header("User-agent") == "devx/install-tools"
         assert dest.read_bytes() == b"data"