Replace got with native fetch in CLI

[philip-peterson]

Claude says:

Summary

The CLI uses the got library (v12.4.1) in a single place — cli/index.ts — to search for plugins on npm via api.npms.io. Since this project requires Node 22, the native fetch API is available with no additional dependencies.

Motivation

• got is a non-trivial dependency for what is a single GET request
• Native fetch is built into Node 18+, so it can be removed from package.json entirely
• Removes one dependency from the supply chain

Certificate / SSL handling note

There is an existing workaround (added alongside this issue) that passes https: { rejectUnauthorized } to got based on the NODE_TLS_REJECT_UNAUTHORIZED environment variable. This handles corporate proxy environments that perform SSL inspection with a self-signed certificate chain.

When migrating to native fetch, this workaround needs to be carried over. Native fetch in Node.js is built on undici, and disabling certificate verification requires passing a custom undici.Agent:

import {Agent} from 'undici';

const dispatcher = process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0'
  ? new Agent({connect: {rejectUnauthorized: false}})
  : undefined;

const response = await fetch(URL, {dispatcher} as RequestInit);

This is slightly more verbose than the got equivalent, but keeps the same behaviour.

Scope

• Remove got from package.json and cli/index.ts
• Rewrite lsRemote() in cli/index.ts using native fetch
• Carry over the NODE_TLS_REJECT_UNAUTHORIZED handling using a custom undici.Agent
• undici is already a transitive dependency (bundled with Node.js), but may need to be listed explicitly for the type import