feat: add cloud workspace downloads

[jamesdoh0109]

Summary

• Add a runtime endpoint that serves the latest completed root-workspace checkpoint.
• Add the simple CLI command: telos download SESSION_ID.
• Stream the archive to an automatically named telos-workspace-SESSION_ID.tar.gz file without buffering it all in memory.
• Refuse to overwrite an existing file and publish the download only after it completes successfully.
• Reject symlinks and non-regular archive files, including FIFOs.
• Update the CLI reference documentation.

What users receive

The archive contains the files in the saved root workspace, including hidden files and repository metadata such as .git. It does not include Telos control-plane state stored outside that workspace. Because agents can write secrets into project files, the archive must still be treated as sensitive.

This is the latest completed checkpoint, not a live snapshot. It is unavailable before the first checkpoint and can be one cycle behind while work is actively running.

Rollout

Publish and verify the exact v0.1.6 runtime before the dependent Cloud PR is merged or deployed. Cloud pins new deployments to that version. Existing durable deployments keep their older immutable runtime, so users need a new v0.1.6-or-newer deployment to use workspace download.

The bundled CLI documentation becomes available through the normal Telos release and promotion process.

Verification

• go test ./...
• go test -race ./cmd/telos ./internal/cloud ./internal/sessionapi ./internal/telosd ./internal/platform
• bazel build //skills:telos_cli_bundle
• Independent adversarial review found no remaining material issues
• Occam review passed: reuse the existing checkpoint and streaming APIs without adding export jobs, storage, or signed URLs