The correct solution here is ...

While that is an option, there is another way to look at it: this means that the client can't differentiate between an error the developer made, such as a typo in the URL or moving download.pl to another location, and an error the user made in requesting the file from download.pl, such as the target file not existing. That is an argument for adding an additional protocol layer, e.g. with JSON, as described in the other replies - 200 OK would mean the client reached the server successfully, and any other HTTP status code means that there is an issue in communicating with the server.

Produce a reply, with either a 200 OK status if presenting a file, or 404 Not Found otherwise.

TIMTOWTDI applies here as well. Since the script in the OP is simply serving up a raw file, this could theoretically be done more efficiently by the webserver itself, and the CGI script could be giving a 3xx redirect to that file. Granted, we currently don't have enough information about what the OP is doing to know if there might be access rights or similar to consider, but again, this is a suggestion to think about it in a more TIMTOWTDI way.