Harden generated docs external setup

[danielporterda]

What changed

• add bounded retries around complete Daml installer executions, covering failures inside the downloaded installer as well as download failures
• declare Daml-tooling requirements in generated-doc target metadata and pass them through the dynamic Actions matrix
• run Daml setup only for splice-token-standard-v2, daml-standard-library, and daml-script; the other 14 targets skip it
• share bounded GitHub API retries across Canton, Wallet Gateway, Wallet SDK, and dApp SDK release-note fetches

Why

Recent scheduled runs exposed two transient external-I/O failure modes: get.digitalasset.com reset connections while the installer was determining the latest SDK, and a Canton release-note fetch failed TLS verification against the GitHub API. The workflow also installed Daml tooling for every matrix target even though only three targets invoke DPM/Daml commands.

Impact

Transient installer and GitHub API failures now receive three attempts with bounded linear backoff. Non-Daml targets avoid an unnecessary external installer dependency and setup time.

Validation

• 55 passed across the focused generated-PR, retry-helper, installer, Canton release-note, and Wallet release-note tests
• simulated installer failure twice followed by success on the third attempt
• simulated GitHub URL/TLS failures twice followed by success on the third attempt
• focused Ruff error/import checks
• Python compilation
• shell syntax validation
• workflow YAML parsing
• exact generated matrix assertion for Daml and non-Daml targets
• git diff --check
• live no-write Canton release-note check reports the checked-in releases current
• PR-branch automation run passed with exactly the requested targets:
  • splice-token-standard-v2 ran Daml setup successfully and generated with no drift
  • canton-release-notes skipped Daml setup and completed its GitHub API-backed generation with no drift
  • no generated update PRs were created