…crawl on warm-cache miss (#70)

Closes the loop on the e2e redness: `main`'s e2e run #47 failed on both
attempts (I re-ran its failed jobs to confirm determinism). Local
reproduction on the exact toolchain identified two causes — one
introduced by #68, one long-latent:

## 1. `:live_download` leaked into the default suite (regression from
#68)

`test_helper.exs` never excluded `:live_download` — those tests were
only kept out of `mix test` by riding on their `:external_api` tag. When
#68 removed that tag (correctly, to fix the `--include`/`--exclude`
interaction), the ~10–50MB download tests fell into the **default**
suite, where the e2e-opsm "Run all tests" step runs them on runners
without nickel → `{:error, {:nickel_not_installed, "zig"}}` × 2. Fix:
exclude `:live_download` explicitly in `ExUnit.start/1`; run them
deliberately via `--include live_download`.

## 2. `HyperpPolymathForge.fetch_package/2` re-crawled the GitHub org on
every miss

A per-name cache miss triggered `refresh_index()` — a full
unauthenticated org listing — even when the index was already populated.
Any absent package name burned rate limit, and on CI runners the 403
surfaced as `{:error, {:http_error, 403}}` instead of `{:error,
:not_found}`. The ETS-seeded test at `hyperpolymath_forge_test.exs:321`
documents the intended contract ("cache is non-empty, so refresh_index
won't fire") — the implementation just never honored it. A miss against
a warm cache now returns `:not_found` with no network I/O; a cold cache
still refreshes and still propagates refresh errors. The warmth
criterion mirrors the existing `ensure_index/0`.

## Verified (OTP 28.3.1 / Elixir 1.19.5)

- `mix compile --warnings-as-errors` — clean
- Full default suite (`mix test`) — **807 tests, 0 failures**
(previously 2)
- e2e step (`--include e2e --include integration`) — 55/55
- runtime-api step (`--include external_api --exclude live_download`) —
9/9, 6 excluded
- `just toolchain-check` — green

With this, all three e2e workflow test commands pass locally against
`main`'s toolchain; the only expected remaining red on this PR is the
pre-existing governance ReScript policy check (fails identically on
`main`; owner-decision).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Kq24sZCEohSrNFXSuEuz6C)_

Co-authored-by: Claude <noreply@anthropic.com>