feat: download cds get profiles from GitHub instead of local checkout

[RonaldHensbergen]

Summary

cds get previously copied a profile and its dependent module/runtime assets from a local checkout (the current repository, or --remote <local-path>). By design, it now downloads from GitHub instead:

• Default (no flags): fetches this project's upstream repository at the main branch via the GitHub tarball API (api.github.com/repos/{owner}/{repo}/tarball/{ref}) — no git binary required.
• --remote <owner/repo> or a github.com/... URL, plus optional --ref <branch|tag|sha>: fetches a specific fork/revision from GitHub.
• --local <dir>: explicit opt-in to use an existing local directory instead of downloading (mutually exclusive with --remote/--ref), for offline/dev workflows.

Changes

• cli/getter.py: added GitHub remote parsing (owner/repo shorthand, github.com URLs, git@github.com: SSH form) and tarball download/extraction via urllib + stdlib tarfile (no new dependency). --local now explicitly selects a local directory; fetch_profile() gained ref and local parameters.
• cli/main.py: cds get gained --ref and --local CLI flags; --remote help text updated to describe the new GitHub-only semantics.
• README.md: documented the new default download-from-GitHub behavior and flags.
• tests/test_getter.py / tests/test_main.py: updated existing local-repo tests to use --local/local=, and added coverage for GitHub remote parsing, default-remote download (mocked), explicit owner/repo + ref, download failure handling, unresolvable remote errors, and the --remote/--local mutual-exclusivity check.

Testing

• python -m unittest discover -s tests -p "test_*.py" — 536 tests, OK
• ruff check . — all checks passed
• npx markdownlint-cli@0.49.0 README.md — clean

[RonaldHensbergen]

Review: LGTM ✅ (posted as a comment since GitHub doesn't allow self-approval)

Reviewed the diff and CI (all 11 checks passing). The core design is solid:

• Uses the safe tarfile.extractall(..., filter="data") extraction mode, correctly mitigating path traversal/symlink attacks on the downloaded archive.
• Download is scoped to a fixed api.github.com host with validated owner/repo values (no SSRF via arbitrary URL/scheme injection) and a 30s timeout.
• Network/archive failures (HTTPError, URLError, tarfile.TarError) are caught and wrapped in clean GetErrors, no raw tracebacks.
• Existing profile-path/module-traversal guards (_validate_source_repository, _resolve_source_profile_path, _collect_asset_roots) are unchanged and still apply correctly to the extracted directory.
• Good test coverage for remote parsing, mocked downloads, ref selection, and --remote/--local mutual exclusivity.
• Temp directory cleanup via context manager, including on error paths.

Two independent reviews turned up a few non-blocking follow-ups, now tracked as separate issues so they don't hold up this PR:

• cds get: cap GitHub tarball download/extraction size #505 — no size cap on tarball download/extraction (memory/disk exhaustion risk from a very large or malicious --remote)
• cds get: --ref silently ignored when combined with --local (contradicts docs) #506 — --ref is silently ignored when combined with --local, contradicting the documented mutual exclusivity
• cds get: unhelpful error message on unexpected GitHub tarball layout #507 — unhelpful error message if the GitHub tarball layout is ever unexpected
• cds get: missing CHANGELOG entry for breaking default-behavior change (#493) #508 — missing CHANGELOG entry for the breaking change to cds get's default behavior (local checkout -> GitHub download)

None of these are security-critical or regressions in existing guarantees. Good to merge.