Function pull_transitive 

pub fn pull_transitive(
    registry: &Registry,
    primary_vfr: &str,
    out_dir: &Path,
    max_depth: usize,
) -> Result<PullResult, String>

Pull a frontier and recursively pull every cross-frontier dependency it declares, verifying each pinned snapshot hash along the way. The primary’s manifest must live in registry.

Doctrine notes:

• Verification is total: any snapshot mismatch, missing locator, or missing dep-manifest aborts the whole pull. Partial trust is not a state v0.8 supports.
• Cycles are impossible by content-addressing (a vfr_id is a hash of bytes that include the dependency list). A visited-set guards anyway; revisiting the same vfr_id is a no-op.
• max_depth caps recursion. The primary is depth 0; its direct deps are depth 1, and so on. Reaching max_depth without exhausting deps is an error so the caller can decide to retry with a higher cap.