security: stream remote responses with hard limits and safe cache commits

[rwang23]

Closes #8

What changed

• stream Catalog, Registry, and Full Skin responses under explicit byte caps
• reject unexpected MIME types, oversized declared bodies, truncated reads, and request timeouts
• disable redirect following and add connect deadlines for fixed-origin fetches
• publish verified cache candidates with a durable, never-overwrite operation so a valid cache remains available

Verification

• npm run desktop:check (30 Rust tests)
• npm run test:source

Residual verification

• PR CI will exercise the generated-artifact and cross-platform build matrix.

[rwang23]

Superseded by #26, now merged into main at e2ed6e8. This branch head is already included in main; closing the draft avoids duplicate review and merge work.