Add GitHub API archive fallback

[sjquant]

Why

GitHub HTTPS bundle sources can fail in agent environments when the default git clone transport receives a proxy 403 before repository access is resolved. Skul should keep Git as the default transport while offering a GitHub API archive fallback for working-tree-only bundle materialization.

Changes

• Keep git clone as the default remote source transport, with SKUL_GITHUB_TRANSPORT=archive as an opt-in archive-first mode for GitHub HTTPS sources.
• Add an in-process Node fetch GitHub REST API archive transport that uses GH_TOKEN before GITHUB_TOKEN, resolves branches, tags, commit SHAs, and default branches, and downloads /repos/{owner}/{repo}/tarball/{ref} without invoking gh or node -e helper scripts.
• Honor requested refs when fetching uncached remote sources, including fresh apply runs and git transport clones.
• Store and validate Skul archive metadata only for cache directories without .git, and use that metadata for inspect, update, and restore flows.
• Preserve existing archive caches during failed archive updates by swapping through a backup directory, and stream archive downloads to disk instead of buffering tarballs through stdout.
• Normalize GitHub API authentication, rate limit, forbidden, and not-found errors, while keeping token values out of clone URLs, logs, errors, git args, and script strings.
• Document archive cache limitations: working tree contents only, no Git metadata, submodules, or Git LFS objects.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	89.5% ⬇️ -0.33%	3462 / 3868
🔵	Statements	89.21% ⬇️ -0.27%	3507 / 3931
🔵	Functions	91.23% ⬆️ +0.30%	770 / 844
🔵	Branches	80.07% ⬇️ -0.62%	2375 / 2966

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/bundle-fetch.ts	81.35%	70.7%	95.16%	81.35%	199-202, 241, 253, 272-277, 287-290, 320, 356-363, 416-426, 469-481, 489, 528-538, 550, 565, 577-608, 620, 735-736, 754-759, 788-799, 806, 815, 829, 860, 884-888, 901, 959, 982-986, 1019, 1031, 1074, 1083, 1094, 1113, 1123-1125, 1155, 1193, 1212-1215, 1225-1229, 1234, 1243, 1260-1264, 1286-1288
src/index.ts	88.13%	76.22%	89.68%	88.38%	155, 176, 349, 425-428, 485-488, 519, 524-525, 542-545, 590-594, 624-626, 651, 660, 700, 711, 748, 760-768, 801, 808, 849-853, 905, 914, 939, 950, 989-992, 1047, 1062, 1137-1143, 1275-1279, 1306, 1369-1374, 1430-1432, 1444, 1453-1455, 1460, 1469-1486, 1506, 1513-1533, 1546, 1681-1682, 1861, 1875, 1915, 1974, 2013, 2038, 2057-2059, 2278-2282, 2329, 2339-2348, 2370, 2405-2418, 2584-2586, 2871, 2894, 2922-2927, 2931, 2946-2956, 2973, 3015-3016, 3037, 3041-3043, 3061, 3078-3081, 3100, 3186, 3511, 3686, 3700, 3713, 3723, 3740, 3744, 3752, 3760, 3773, 3784, 3818, 3977, 4024-4040, 4165, 4170, 4297-4305, 4355-4359, 4386, 4443, 4445, 4455-4459, 4520, 4532, 4544-4546, 4550, 4568, 4587, 4595-4597, 4693-4701, 4717-4721, 4728-4736, 4852-4854, 4882-4884, 4900-4902, 4915-4918, 4947-4948, 5067, 5150-5152, 5171-5173, 5206, 5283, 5413-5415, 5430-5432, 5451-5453, 5493-5497, 5598-5600, 5621-5623, 5647, 5661, 5689-5691, 5924, 5934, 6084-6092, 6196-6198, 6210, 6242, 6248, 6273, 6303-6305, 6326, 6349-6362, 6393-6396, 6409-6418, 6485-6487, 6505-6507, 6609-6613, 6864, 6904, 6941-6943, 7017-7020, 7043-7047, 7074, 7105, 7107, 7117-7121, 7138-7139, 7209-7216, 7230-7234, 7241-7249, 7336-7338, 7348-7349, 7368-7370, 7386-7388, 7401-7404, 7428-7429, 7453, 7477, 7516, 7538, 7543-7545, 7549-7550, 7572-7574, 7582, 7586-7593

Generated in workflow #124 for commit 5c6c604 by the Vitest Coverage Report Action