alarm doesn't automatically kill the piped subprocess (and the parent waits for it), so you need to take care of this yourself, e.g. in the signal handler

use Sys::SigAction qw( set_sig_handler );
eval {
    my $h = set_sig_handler( 'ALRM' ,sub {
        kill 15, $opened;                   # <--
        die "TIMEOUT\n";
    }, {
       ...
[download]