Route get <uuid> agent mode through download_and_apply_patches_into instead of a second copy of the engine #1835

[agent] Filed by the scheduled architecture audit (audit-cli-tests). Register: register comment.

Kind: refactor. Register ID: T01.

Problem

get <uuid> in agent mode does not use the shared download engine. Instead, save_patch_record plus save_and_apply_patch (get.rs L1931-L2172, about 240 lines) repeat, for a single patch, every step of download_and_apply_patches_into (agent_download.rs L1700-L1886):``

• the lock acquire;
• the fail-closed manifest read-modify-write;
• the files_for_manifest guard;
• decide_patch_action;
• write_all_patch_blobs and the unwind on failure;
• the uuid-drift and gitignore warnings;
• the lock hand-off and the nested apply;
• record_apply_outcome.

The copies have already drifted:

• No-files message: "Patch X has no applicable files; nothing to apply" in get.rs L1951, against "patch has no applicable files" in the engine.```
• Blob failure: get prints its own "Error: Blob decode or write failed for patch" line and builds a different envelope (L1976-L1995).
• Unchanged record: the uuid path re-applies a record that hasn't changed (L2064-L2068). The engine applies only added or updated records.
• persist_blobs: the uuid path ignores DownloadParams.persist_blobs.

The engine already supports a pre-fetched patch: fetch_selected_patches takes a prefetched map, and the vendored arm of the uuid path already goes through download_patch_records_preflighted with it.

Proposed change

• Build the one-element prefetched map from the PatchResponse that get <uuid> fetched, and call download_and_apply_patches_into, as the vendored arm does.
• Delete save_patch_record and save_and_apply_patch.
• If the re-apply of an unchanged record (scan --sync / --mode agent never re-applies an already-recorded patch, so after a fresh Hatch env (or any reinstall) it exits 0 with the package unpatched #454) is still wanted, make it an engine rule for every caller, not a get-only branch.

Size

get.rs and possibly agent_download.rs. About −230 / +30 lines.

Acceptance criteria

• get <uuid> human and --json output stay the same, except the no-files and blob-failure wording, which takes the engine's form.
• The existing get uuid tests in get.rs mod tests and tests/get/ stay green, and they are updated only where they pinned the drifted wording.
• --save-only, --dry-run and the nested-apply exit codes are unchanged.