fix: harden middlecache downloads and consume OpenAPI archive - #33085

The 24MB openapi.json was fetched over HTTP during the build. With
default Accept-Encoding, middlecache served on-the-fly brotli, which has
no integrity checksum; a corrupted/truncated transfer silently
decompressed to garbage, intermittently failing the build with
"Bad control character in string literal in JSON".

- downloadToDotTempIfNotPresent now requests identity encoding (no
  brotli), writes atomically via a temp file, checks response.ok and
  Content-Length, and retries up to 3 times. An optional validate
  callback makes the whole download+validate unit retryable.
- getSchema now prefers the gzip-compressed openapi.tar.gz from
  middlecache (extracted with tar, validated by gzip CRC32 + JSON.parse
  before use), falling back to the raw openapi.json.
- Adds unit tests covering retry, validation, size mismatch, and
  existing-file handling.

bin/fetch-skills.ts had its own inline tar spawn; extractTarGz (shared
with the OpenAPI archive path) now supports stripComponents and
fetch-skills uses it instead. Adds extractTarGz unit tests.

The build failed intermittently with ENOENT on openapi.json because
getSchema downloaded the schema lazily during prerender. Pages render in
parallel, so concurrent downloads raced on the shared .tmp file — a
retry's cleanup could delete a sibling call's freshly-written file.

Mirror the skills flow: a new bin/fetch-openapi.ts (run from the
prebuild/predev hooks) downloads the gzip-compressed openapi.tar.gz from
middlecache and extracts openapi.json to .tmp before the build starts.
getSchema now just reads the local file.

- bin/fetch-openapi.ts: download archive (fall back to raw openapi.json),
  extract + parse as the integrity check; --soft for predev
- package.json: prebuild/predev run fetch-openapi after fetch-skills
- api.ts: getSchema reads .tmp/.../openapi.json, single-flighted
- custom-loaders.ts: getDotTmpPath now resolves the repo root by walking
  up to package.json (tsx prebuild and the bundled prerender resolve
  import.meta.url to different depths); downloadToDotTempIfNotPresent
  dedups concurrent same-destination downloads
- tests: concurrent-download dedup + retry-after-failure coverage

Verified: full `pnpm run build` succeeds (8932 pages), check/lint/tests
pass.

- custom-loaders: reject tar members with `..` segments or absolute
  paths (zip-slip); reject on spawn `error` instead of hanging; capture
  tar stderr in extraction errors
- openapi-schema: extract to a staging dir and atomically promote on
  success, so a failed extract/parse leaves no stale files to mask a
  fresh download failure
- tests: check spawnSync status when building fixtures; add regression
  tests for unsafe tar member paths
- package.json: share the fetch-skills + fetch-openapi command via a
  single fetch:assets script used by prebuild and prebuild:incremental