Module fetch 

Fetch + cache + sha256-verify for declared deps.

Cache flow per dep:

1. If cache_path exists and its sha256 matches expected_sha256 → cache hit; return (zero HTTP).
2. If cache_path exists with a wrong sha → drop it and fall through.
3. If offline is true → return FetchError::OfflineMissing.
4. Otherwise: HTTPS GET → write to <file>.tmp → sha-verify → atomic rename to cache_path.

Structs

FetchPlan

Resolved per-dep fetch parameters: where to download from, where to cache the bytes, and what sha256 to verify against.

Enums

FetchError

Functions

fetch

Ensure plan.cache_path exists and matches plan.expected_sha256.