feat: WithNoSystemFallback and WithGitKnownHosts

[liamg]

First PR in the stack that makes grabber a side-effect-free replacement for how the parser/runner use go-getter. This one is the lockdown: stop reaching into ambient/system state unless the caller allows it.

What

WithNoSystemFallback()

One switch that disables all ambient/system fallbacks:

• the SSH agent (SSH_AUTH_SOCK)
• the system git credential helper (git credential fill)
• the archive-fallback environment-variable tokens (GH_TOKEN/GITHUB_TOKEN/GITLAB_TOKEN/GL_TOKEN/BITBUCKET_TOKEN)
• the ~/.ssh/known_hosts default host-key check
• the Mercurial (hg) subprocess (hg downloads error out — hg is 100% subprocess-based)

Intended for locked-down environments (like the runner) that must not read the ambient user/system configuration.

WithGitKnownHosts([]byte)

Verifies SSH host keys against known_hosts data in memory — no temp file, no disk read. Unknown hosts are allowed; a host whose recorded key has changed is rejected (the "new host is fine, changed key is a red flag" model). Hashed entries (|1|...) are skipped.

Host-key resolution precedence: InsecureSkipHostKeyVerify → configured known_hosts → system default (~/.ssh/known_hosts, only when system fallback is on) → accept-any-with-warning.

Why

The runner currently feeds git auth through disk + env (writes id_rsa, sets GIT_SSH_COMMAND, installs a ~/.gitconfig credential helper, exports GIT_SSL_*). To migrate it onto grabber, grabber must (a) never depend on that ambient state and (b) let the caller turn it all off. This PR delivers (b) and the host-key piece of (a).

Testing

• Exhaustive unit coverage of the known_hosts matcher: match, changed-key rejection, unknown-host allow, non-standard ports ([host]:port), host,ip patterns, multi-key, hashed-entry skip, malformed input. Host-key strategy selection covered 100%.
• Gating verified for the credential helper (via a stubbable seam), the archive env-token, the SSH-agent path, and hg.
• End-to-end: an SSH integration subtest pins a deliberately-wrong host key and asserts a real clone is rejected — proving WithGitKnownHosts is enforced through go-git, not just unit-tested.
• go build, go vet, golangci-lint (0 issues), and go test -short -race ./... all clean.

Notes

• Behavior change: with WithNoSystemFallback(), previously-implicit sources (agent, helper, env tokens, disk known_hosts, hg) are off. Default behavior is unchanged when the option isn't set.
• The system git credential helper call is indirected through a package var purely so its gating is unit-testable.
• Part of a planned stack (A–E): TLS + SSRF + transport, dynamic credentials, probe + smart scheme fallback, and an optional tfregistry protocol.