Limit GitHub installs and fetch assets directly

[ije]

GitHub asset URLs now fetch the requested file directly from raw.githubusercontent.com. Assets from large repositories such as Fluent UI Emoji remain available without installing the repository, even when it has already been recorded as oversized. URLs with a build target segment first redirect to the canonical asset URL, preserving escaped paths and query strings. Responses retain MIME types, immutable caching, ETags, and HEAD support, with a 50 MiB file limit and a 30-second download timeout.

Module builds still install their repositories. Installs enforce a 256 MiB limit on downloaded and unpacked archives and a 30-second deadline covering download and extraction. Failures remove partial files. Oversized repositories are recorded under <workDir>/gh-too-large/; later installs of any ref return repo is too large without downloading again, including after a restart. Repository names are matched case-insensitively, and timeouts and caller cancellations remain retryable.

The Fluent UI Emoji integration test is restored. The import-map resolution test pins React DOM to 19.2.4 to match its referrer and scheduler expectations and reports errors when adding the import.

Validation:

• go test ./server ./internal/* -count=1 passed. Regression coverage includes direct asset requests, missing files, escaped paths, conditional requests, HEAD, file limits, module installation, archive limits, persistent rejection across refs, and cancellation.
• All 18 fixed-URL and GitHub integration tests passed against a fresh server cache with Fluent UI Emoji and OXC pre-recorded as oversized: deno test -A --unstable-fs --check --no-lock --reload=http://localhost:8080 --location=http://0.0.0.0/ -q test/fixed-url/ test/gh/.
• Verified the original Fluent UI Emoji SVG and HEAD requests return 200, ETag revalidation returns 304, and no repository installation is created.