lib-management.dep-fetcher-test v0.1.0: TAP suite + fixtures

27-assertion TAP-style suite for lib-management.dep-fetcher v0.1.0:

  - 4 internal-helper tests (id_to_path, gitea_slug_for incl. .git
    exception)
  - 6 JSON decoder tests (objects/arrays/nesting)
  - 3 conflict-detection tests (synthetic two-parent fixture)
  - 3 closure-walk tests (clean fixture, check_only mode)
  - 3 case-B (clean) tests
  - 4 case-C (dirty) tests
  - 4 case-D (wrong-tag → silent checkout, post-state verification)

Cases A (missing+clone) and E (broken describe) need network or
contrived corruption; out of scope for slice 5 per architecture spec.

Fixture matrix:
  conflict_a/  — static, no .git needed
  clean_b/     — .git at v0.1.0 (clean)
  dirty_c/     — .git at v0.1.0-1-g…-dirty
  wrong_tag_d/ — .git with tags v0.1.0 + v0.2.0, HEAD at v0.1.0

fixtures/_setup.sh reconstructs the .git states (idempotent — restores
manifest.lib content after the case-D silent-checkout side-effect).
Required pre-step before each test session; the test-runner blocks
with a clear error if fixtures/_setup.stamp is missing.

.gitignore covers the .git subdirs and the stamp file — they are
local-machine state, rebuilt by _setup.sh from the source-tracked
manifest.lib seed files.

fixtures/clean_b/install/libs/lib-x/consumer/manifest.lib

@@ -0,0 +1,6 @@
+{
+  "id": "lib-x.consumer",
+  "version": "0.1.0",
+  "api_min": "0.1",
+  "deps": []
+}

fixtures/clean_b/manifest.module

@@ -0,0 +1,9 @@
+{
+  "id": "fixture-clean-b",
+  "version": "0.1.0",
+  "kind": "module",
+  "api": "^0.1",
+  "deps": [
+    {"id": "lib-x.consumer", "version": "0.1.0"}
+  ]
+}