downloadFile() never flushed or closed its write stream (the awaits on write()/close() awaited non-promises), so the small .sha256 file could be read back empty, producing a checksum "mismatch". The recovery path then deleted the cli folder while that file's handle was still open and returned Ok without re-verifying. On Node 24 (VS Code 1.123+) that unflushed-handle delete throws ENOTEMPTY, killing activation.

- utils.ts: stream the download with real backpressure (await drain) and await stream/promises finished() so the data is flushed and the fd closed before returning; destroy the stream on error so no handle leaks.
- ensureLangsUpdated.ts: extract verifyCli(); re-verify the checksum after a redownload (Err on persistent mismatch instead of trusting it); replace del's deleteSync with removeCliFolder() using fs.rm {maxRetries, retryDelay}, returning a Result so a failed delete can't crash activation; harden parseSha256Sum; add an optional opts {downloadUrl, version} for testing.
- Tests: new downloadFile suite (incl. the empty-read regression) and end-to-end ensureLangsUpdated coverage, including the real uppercase+CRLF 0.39.4 checksum format.
- Bump to 3.5.3 + CHANGELOG.