v2 fetch: zero-request frozen paths (#414), Go frozen re-download, TS lock platforms and error class, Python index duplicates (#487)

[EricAndrechek]

Refs #487
Refs #414

The production-v2 fetch channel honours --lock, --frozen and --update, so its pinned paths ship at 2.0.0. This fixes the fetch-layer defects of #487 and the zero-request frozen paths of #414 in all four bindings.

The pinned path (#414, and Go's #487 defect 1)

• --frozen with a warm cache makes zero requests. Before any request it looks for unpacked/sha256/<pinned manifest>/verified.json (cache, then system directories); a record for the platform that records exactly the pinned manifest, layer and bundle digests is used as it is. Anything else falls through to the by-digest fetch. Go made 3 requests and 42.5 MB on every run (measured on 1.0.2; on v2 the new frozen-warm-cache-zero-requests case failed with 3 requests before the fix).
• --frozen --offline verifies the installed build against the lock with zero network. A missing lock entry, or no installed build matching the pin, is CHTYPES_ARTIFACT_PINNED. --offline alone is unchanged. The Go CLI no longer rejects the combination as a usage error.
• docs/guides/fetch-v1.md section 6 spells this out. Three cases in the generated corpus (genfixtures, both fetch-v1 and fetch-v2 regenerated): frozen-warm-cache-zero-requests, frozen-offline-lock-match, frozen-offline-lock-mismatch.

TypeScript (#487 defects 2 and 3)

• fetch --lock pinned only the host platform: the all-platforms write was an opt-in that only the conformance runner set. It is now the default (lockAllPlatforms: false opts out) and the runner no longer sets it, so lock-write-all-platforms exercises the default.
• Breaking: ArtifactError extends ChtypesError. The abstract base moved to ocifetch/errors.ts (no import cycle); it is still exported as ChtypesError, codes and messages are unchanged. Names are unchanged, so no parity allowlist change.

Python (#487 defect 4)

• index.json is deduplicated by digest on merge (test_ensure_index_json_never_gets_a_second_entry_for_one_manifest fails without the fix).

Verification

Go, Python and the generator gates were run locally and are green. TypeScript and Rust are verified in CI only.

🤖 Generated with Claude Code