Sorry for this late reply, i was kind of busy 
Back to your issue, modify the file download.php like:
<?php
$filename=isset($_GET["product"])?$_GET["product"]:null;
header('HTTP/1.1 301 Moved Permanently');
header("Location:/product/download/".$filename);
exit;
?>
Add this rule to your url rules:
'download/<product:\w+>' => 'product/download',
Now, in the product controller, have:
public function actionDownload($product)
{
Yii::import('application.extensions.forcedownload.*');
if($product== "product-cl") $filepath = "./protected/download/cl.pdf";
//here there's a long list of 150 products
$fparts = pathinfo($filepath);
$safename = $filename;
$myfd = new forcedownload();
$myfd->setSafename($safename);
$myfd->setFilename($filepath);
$myfd->output();
}
All the above code will work with your current link format, meaning that when somebody will access a url like:
download.php?product=product-cl it will be taken to the download.php file, this file will add a header to let the browser know the resource has been permanently moved and will redirect the user to your new url for download: /download/product-cl.
Once this new url is requested, it is handled by Yii and will basically download the file.
All the above is for backward compatibility, from the moment you make these changes, you will generate any new download url using: Yii::app()->createUrl(‘product/download’,array(‘product’=>$name));
Just to make it clear, you will still have your old download urls in the website (download.php?product=1234) but that file will exists there only for compatibility reasons and in the future, when you get rid of the products which directly links to that file, you can safely remove the file too and only use the new Yii download method.
Hope it was clear enough.