Replace the Rust curl shim with real curl

[NathanFlurry]

Today curl in the VM is a Rust reimplementation (secure-exec/registry/native/crates/commands/curl, shipped as @agentos-software/curl, source: "rust"), not real curl. It diverges from curl's CLI — e.g. it rejects a bare hostname:

:/$ curl google.com
curl: unsupported argument `google.com`

Real curl normalizes google.com → http://google.com; the shim does not, and likely lacks many flags/behaviors.

Goal: ship real curl so behavior matches upstream.

Options

1. Compile real curl (C) to wasm32-wasip1 with libcurl + a TLS backend (wasi-compatible mbedTLS/wolfSSL/BearSSL), packaged like the other C registry commands. Highest fidelity, most effort (TLS-on-WASI is the hard part).
2. Close the gap in the Rust shim as an interim: scheme normalization for bare hosts, common flags (-X, -H, -d, -o, -L, -s, -I), correct exit codes.

Recommendation: do (2) as a quick fix now (covers the reported breakage), track (1) as the real solution.

Implementation lives in secure-exec registry/software/curl + registry/native. Surfaced from just shell testing.

Related: the WARN could not retrieve pid for child process line also leaks into shell output on this path (separate shell-stripper bug).