New package for fetching files from HTTP with conditional-GET semantics
and a sidecar metadata file that persists ETag/Last-Modified across
restarts. Splits connection vs download timeouts, supports custom auth
headers (stripped on cross-origin redirect), and exposes sentinel errors
for callers branching on failure mode. Integration tests included.
