fix: retry LLM calls and force IPv4 DNS on WSL2 (#19)

[nujovich]

Summary

Fixes #19. On WSL2, NAT routing can resolve remote LLM API hosts to an unreachable IPv6 address, making `fetch()` hang until `ETIMEDOUT`. This reimplements the mitigation on the current provider architecture (the original #23 patched `callAnthropic` in `prompts.mjs`, which was since refactored into `lib/llm_providers/*/client-impl.mjs`, leaving #23 unmergeable).

Changes

• New `lib/net-utils.mjs`:
  • `isWSL2()` / `hasDnsResultOrderOverride()` — WSL2 detection via kernel metadata, honoring any user `--dns-result-order`.
  • `applyWsl2DnsWorkaround()` — forces `ipv4first` DNS only on WSL2 and only when the user hasn't overridden it. Called once at CLI startup.
  • `isRetryableNetworkError()` + `fetchWithRetry()` — shared helper that retries only transient network errors (ETIMEDOUT/ECONNRESET/…), never HTTP 4xx/5xx responses. Returns the `Response` so each client keeps its own status handling.
• The anthropic, ollama and openrouter clients now go through `fetchWithRetry`. Uniform path since the IPv6 hang affects any external fetch, not just Anthropic.
• `lib/net-utils.mjs` added to package `files` (guarded by `check:pack`).

Verification

• 467 tests pass (29 new for net-utils, TDD). Coverage: net-utils 95%, global 94% (threshold 80%).
• `npm run check:pack` green.
• Verified on a real WSL2 host: `applyWsl2DnsWorkaround()` flips the DNS result order to `ipv4first`; CLI boots normally.

Supersedes #23.