http surface consolidation: land the agnostic http.Client (extdeps/http/client.dag), dissolve the curl.Http nickname, declare the redfish hardwired-transport debt

[gunbai-bot]

The fifth-http-surface consolidation

A probe GET surfaced that there is no canonical http-client GET in extdeps — the concept was forked across four partial surfaces (http/server.dag server-side only, curl.Http Post/Download only, redfish.Http GETs with baked DMTF paths, test/http_pilot rest-pilot). Minting a probe service would have been surface #5. This PR lands the missing node instead: the agnostic http-client interface, per the §3 shape/transport/policy split.

What changed

• NEW dag/extdeps/http/client.dag — the client half of extdeps/http (RFC 9110 anchor): service http.Client with
  • Get { url } → { body, success } via curl -fsS (fail-closed: HTTP ≥ 400 → nonzero exit → success=false, no fabricated body) — the probe GET,
  • PostJsonFromFile / DownloadToFile moved verbatim from curl.Http.
  • A typed layering note: shell/curl argv is ONE bound handler of the shape; transport rest (config in extdeps/transports/rest.dag) is the peer handler; REST itself is a behavioral refinement of HTTP (method semantics, statelessness), not a different client.
• dag/extdeps/tools/curl.dag shrunk to the tool authority only (CliTool/version/apt). The curl.Http nickname (curl-spelled names for http-client semantics — the git diff-argv pattern of §3) is dissolved; zero references remain tree-wide.
• dag/extdeps/os/ubuntu_install_media_fetch.dag — the one consumer rewired to http.Client.DownloadToFile.
• dag/extdeps/bmc/http.dag — typed Disposition = Scaffold row + note declaring the §3(b) debt: each redfish.Http op re-spells the curl handler per row. Dissolves when the shared transport machinery gains the three axes those argv rows carry by hand (netrc/basic auth, insecure-TLS, body-from-file). NOT rewired now: live BMC consumers (bmc_onboard*, bmc_read_telemetry, srv3_boot_once_cd) execute those rows, and the rewire rides on transport-machinery work plus the v1 recorded-fixture witness — its own lane.
• Witnesses (green by execution + discriminating RED): dag/test/claim/http_client_get_real_execution_witness_test.dag — real-execution roundtrip (mktemp fixture → http.Client.Get file:// → body equality) and a RED control (missing target → success=false, empty body). Enrolled on the established wet rail: excluded from hermetic discovery (witness_exclusion_substrings) + declared Wet entries (bin_witness_wet_entries), same lane as the srv3 real-execution witnesses.

Receipts

• claim_batch --wet … --functions http_client_get_roundtrip_by_real_execution,http_client_get_missing_target_red_control_by_real_execution → both PASS (RED control observes typed curl exit 37).
• ci_floor_plan_witnesses → true over the edited rosters (plan validity + closure compile).
• grep -rn "curl.Http" tree-wide → zero hits.
• Pre-existing, verified NOT this diff (identical on clean base): scoped --entry runs of srv3_install_media_fetch_witness_test / diagnostic_mock_totality_test red in untouched std files (known scoped-universe artifact); local gunbc ci exit-1 (environmental; ci.yml embeds no roster content, so no drift from this change).

Follow-up lanes (not this PR)

1. Redfish defork onto the client shape (blocked on transport axes above; declared by the Scaffold row).
2. RFC 9110 protocol home consolidation (server.dag/rest.dag double-anchor) and the layer-home question for HttpMethod/HttpStatus in std/types.dag.

🤖 Generated with Claude Code