fix: replace fetch() with SDK HTTP client in checkMalware

[John-David Dalton (jdalton)]

Summary

• Replace fetch() with createGetRequest/getResponseJson from the SDK HTTP client in checkMalware — enables nock interception, retries, timeouts, hooks, and agent config
• Route by component count instead of token type: ≤ MAX_FIREWALL_COMPONENTS (8) uses parallel firewall API, > 8 uses batch PURL API
• Both paths now normalize alerts through publicPolicy (batch path was previously using server-assigned action field)
• Remove all c8 ignore blocks from checkMalware methods
• Add MAX_FIREWALL_COMPONENTS constant
• Add CLAUDE.md rule: never use fetch() in SDK code

Test plan

• pnpm run fix --all passes
• pnpm check --all passes
• pnpm test passes (592 tests)