chore(deps): bump reqwest 0.12 → 0.13

Source-compatible. The fetcher (`infrastructure/fetcher.rs`) uses
reqwest's stable blocking surface: `Client::builder` with
timeout/redirect/user-agent, `redirect::Policy::custom`, `Url::parse`,
`get().send()`, `content_length()`, and the `Read` impl on the blocking
Response. None changed across the major bump; no source edits needed.

602 unit + 245 PTY/integration tests pass; clippy `-D warnings` clean.

Author: SamuelSchlesinger