Harden release downloads for TLS failures

installer/update-ocsentinel.ps1

@@ -7,6 +7,39 @@ param(
 
 $ErrorActionPreference = "Stop"
 
+function Initialize-OCSentinelTls {
+    $protocols = [Net.SecurityProtocolType]::Tls12
+    if ([Enum]::GetNames([Net.SecurityProtocolType]) -contains "Tls13") {
+        $protocols = $protocols -bor [Net.SecurityProtocolType]::Tls13
+    }
+
+    [Net.ServicePointManager]::SecurityProtocol = $protocols
+    [Net.ServicePointManager]::Expect100Continue = $false
+}
+
+function Get-OCSentinelManifest {
+    param([Parameter(Mandatory)][string]$Uri)
+
+    $parameters = @{ Method = "Get"; Uri = $Uri; TimeoutSec = 60 }
+    if ((Get-Command Invoke-RestMethod).Parameters.ContainsKey("UseBasicParsing")) {
+        $parameters.UseBasicParsing = $true
+    }
+
+    for ($attempt = 1; $attempt -le 3; $attempt++) {
+        try {
+            return Invoke-RestMethod @parameters
+        }
+        catch {
+            if ($attempt -eq 3) {
+                throw "Could not retrieve the OCSentinel release manifest after 3 attempts. Verify that the device can reach gitea.officecom.cloud with TLS 1.2 or newer. Last error: $($_.Exception.Message)"
+            }
+            Start-Sleep -Seconds (3 * $attempt)
+        }
+    }
+}
+
+Initialize-OCSentinelTls
+
 $installRoot = Join-Path ${env:ProgramFiles} "OCSentinel"
 $appExe = Join-Path $installRoot "app\OCSentinelCli.exe"
 $installScript = Join-Path $installRoot "scripts\install-ocsentinel.ps1"
@@ -66,7 +99,7 @@ if ([string]::IsNullOrWhiteSpace($ManifestUrl)) {
 $resolvedManifestUrl = Resolve-ManifestUrl -ManifestUrl $ManifestUrl -Channel $Channel
 Write-Host "Checking update manifest: $resolvedManifestUrl"
 
-$manifest = Invoke-RestMethod -Method Get -Uri $resolvedManifestUrl -TimeoutSec 60
+$manifest = Get-OCSentinelManifest -Uri $resolvedManifestUrl
 if (-not $manifest.version -or -not $manifest.artifactUrl -or -not $manifest.sha256) {
     throw "Update manifest is missing required fields: version, artifactUrl, sha256."
 }