feat(cli): gf ontology module fetch with clone safety rules #1746

Sub-issue of #1732. Depends on the API sub-issue; can proceed in parallel with the fixture sub-issue.

Scope

gf ontology module fetch <owner/repo> --ontology-id <id> --version <v> --digest <hex> --output <file> [--hub <https base>]

• Built in hub_clone.rs on the existing clone safety code: HTTPS only, credential-free URLs, public-network resolution only, bounded metadata and object downloads, private no-follow staging, bounded retries.
• Fetches refs, manifest and the selected module package only, then verifies through resolve_discovered_ontology_module. It writes the verified module document atomically to --output and refuses an existing output.
• Uses separate flags instead of id@version#digest, because ids and versions may contain those characters.
• Exempt from the four-surface multi-ontology contract, like gf clone. No Python or Node work.

Acceptance

• A successful fetch makes exactly three requests (refs, manifest, module object) and never requests the Project package.
• Unsafe locations, an absent descriptor, oversized objects, corrupt bytes and an existing output each fail with a stable hub.* code and leave no output or staging file behind.
• The command is documented next to gf clone.