Expose the public-address-pinned fetch (web-fetch-http) to plugins

[arrow1031]

Observation. @deepseek-ai/dsh-web-fetch-http is exactly what a plugin should use if it fetches user-supplied URLs: DNS answers are validated and then pinned through a custom lookup (no second resolution / rebinding), redirect: "manual" with same-origin hop cap, byte caps and timeouts. But that capability is only wired into the web_fetch tool — plugins cannot reach it.

Why it matters. Plugin authors who need their own fetch (different auth, proxy, binary responses) end up re-implementing it, and the two easiest mistakes are: validating only the first hop and following redirects anyway, and reading await resp.text() with no byte cap.

Suggestion

• Expose something like ctx.web.fetchBytes(url, { maxBytes, timeoutMs, headers }) to plugins, backed by the same address-pinning/redirect logic.
• If that is not wanted, please publish a recommended snippet in the plugin docs, with the two gotchas called out explicitly.