fix(cli): cat resolves a full urn:dig:... via the node ladder without a local store

[MichaelTaylor3d]

Summary

• digstore cat <full urn:dig:...> failed NO_STORE (exit 3) even though a full URN is self-contained (store id + optional pinned root) — reproduced live per #227.
• cat now tries the LOCAL store only when it backs the SAME store the URN names (fast, offline — the existing "cat my own just-committed content" round-trip path, unchanged in outcome). Otherwise it resolves via the §5.3 client->node ladder (--node/$DIG_NODE_URL/node.url > dig.local > localhost > rpc.dig.net), mirroring pull's network read (pull_urn_resource) — including the §8.5 keyless-URN default-view (index.html, falling back to the empty key) resolved over the network via retry rather than a local manifest read.
• The bare 64-hex retrieval-key form is UNCHANGED — it still legitimately requires the active local store.
• Fixed a related correctness detail while adding the network path: the retrieval key (and the decryption key) is always derived from the ROOT-INDEPENDENT canonical URN (canonical_resource_urn), matching what the generation manifest records at commit time, regardless of whether the input URN happens to carry a root_hash.

Blast radius (gitnexus detect_changes, scope=all)

High risk flagged because the change touches commands::mod::dispatch (the central command router) — expected, since cat needed its own store-resolution branch inserted before the shared store-scoped gate. Affected symbols: cat::run/cat_by_urn/cat_by_retrieval_key/write_out, commands::mod::dispatch, pull::rpc_base (made pub(crate) for reuse), cli::CatArgs. No other command's dispatch path is touched. Verified via the full workspace test suite (cargo test --workspace --locked, 395+ tests) — 0 failures, including the pre-existing decoy/tamper verification-failure tests that must still hard-fail rather than silently retry over the network.

Test plan

• TDD: added crates/digstore-cli/tests/cli_cat_urn_no_store.rs FIRST (confirmed RED against the pre-fix code — reproduced the exact NO_STORE/NotFound failures), then implemented the fix (GREEN).
  • cat_full_urn_with_no_local_store_resolves_via_node_ladder — no .dig ever created, --node pointed at a fake dig.getContent responder, decrypts correctly.
  • cat_keyless_full_urn_with_no_local_store_defaults_to_index_html — §8.5 default view over the network.
  • cat_keyless_full_urn_falls_back_to_empty_key_when_index_html_missing — network 404-then-retry fallback.
  • cat_full_urn_for_a_different_store_than_the_local_one_resolves_via_network — a local store IS initialized but for a DIFFERENT store id; routing is keyed on a store-id match, not "any local store exists".
• Regression: existing cli_cat_roundtrip.rs (5 tests, incl. cat_unknown_resource_decoy_fails_verification_exit_5) still green — the local fast path and its anti-decoy verification are unchanged.
• cargo fmt --all -- --check, cargo clippy -p digstore-cli --all-targets --all-features -- -D warnings clean.
• cargo test --workspace --locked — 0 failures.
• §3.5: guest wasm rebuilt, cargo install --path crates/digstore-cli --force --locked, then manually verified the exact repro against the GLOBALLY INSTALLED binary (PATH-resolved, not cargo_bin) with a fake node — passed, then removed the scratch verification file (not part of the permanent suite).
• Coverage: this repo's CI does not currently gate coverage (no llvm-cov step in ci.yml, confirmed) — pre-existing gap, out of scope for this routine fix. Local cargo llvm-cov hit an unrelated native-toolchain (libz-sys/CMake) issue in this sandbox; the new code is covered by 4 new integration tests + the existing local-path regression suite.

Version bumped 0.10.0 -> 0.10.1 (patch — backwards-compatible bug fix, fix:, no API/behavior break for existing callers).

Closes #227