feat: add zed graph package downloads

[ORESoftware]

Summary

Adds a first-party immutable package graph downloader under the shared graph namespace:

zed graph package <org>/<name>@<version> --format <format>

The package subcommand intentionally leaves zed graph github available for the separate GitHub inventory work in #250.

Formats

• JSON, YAML, TOML
• DOT / Graphviz and Mermaid
• JSON5 and XML
• CSV
• MessagePack
• Protocol Buffers

Aliases include yml, graphviz, mmd, messagepack, mpk, proto, and pb.

Transport and output hardening

• requires an exact immutable @version; no implicit mutable latest lookup
• accepts only HTTP(S) registry bases and rejects embedded credentials, queries, and fragments
• sends credentials only via the existing resolved bearer-token path
• disables redirects, preventing credential replay to another origin
• sends representation-specific Accept headers and supports If-None-Match
• caps decoded bodies at 32 MiB by default and 1 GiB maximum
• never reads or prints non-success response bodies
• requires explicit output for MessagePack and Protobuf
• writes file outputs atomically with no-clobber semantics
• leaves output untouched on 304 Not Modified
• emits optional deterministic response metadata on stderr without mixing metadata into graph bytes

Graph authority

JSON, YAML, TOML, JSON5, XML, MessagePack, and Protocol Buffers are treated as lossless interchange formats. CSV, DOT, and Mermaid are explicitly non-authoritative projections.

CLI integration

• modular dispatcher
• complete root help model
• Bash and Zsh completion coverage
• package-coordinate, alias, URL, authority, routing, filename, and atomic-output tests

Related work:

• feat: define dependency graph export representations zed-interfaces#63
• feat(graph): add JSON5, XML, CSV, MessagePack, and Protobuf exports zed-api-server.rs#36
• feat(web): add self-hosted interactive dependency graph workspace zed-web-server.rs#21
• feat(ts): add hardened dependency graph downloads zed-clients#43

[linear-code]

DEN-2869

[ORESoftware]

Current-head checkpoint for 6bd69bf6df74aa7cbd9f54a435abdd9b897ad870:

• formatter and -D warnings gate: green on Ubuntu
• generated completion coverage: green
• modular help / credential-free JSON checks: green
• agents policy, formal review, repository hardening, develop shell, OCI copy mode, nested/self dependencies, Nix interop/fetch/bundle, Windows locking, and polyglot workflows: green
• remaining full CI and cross-platform workflows are queued or running

The PR intentionally remains draft until the remaining current-head jobs complete.

[ORESoftware]

Ready-for-review checkpoint: exact head 6bd69bf6df74aa7cbd9f54a435abdd9b897ad870 is green across all 23 current-head workflows, including full CI, formatter/Clippy, Windows locking, polyglot, formal review, agents policy, repository hardening, Nix interoperability/export/fetch/bundle, nested and self-dependency modes, environment interop, and release-report checks.

[ORESoftware]

Release checkpoint: strict authority validation and interfaces 4d40ae96... pin propagation are preserved locally but not yet republished. The local build reached the new interface revision, then the shared runner exhausted disk while linking unrelated test binaries. Previous focused graph tests/Clippy were green; wait for the final push and CI before certification.