fix(obsidivm): actionable error when the range service is unreachable (#156) (#158)

* test(obsidivm): RED — bridge should give an actionable error when the service is down

The obsidivm:* benchmarks fetch from the OBSIDIVM range service; when it is not
running the bridge throws a bare 'fetch failed' (surfaced as 'FATAL: fetch
failed'), naming neither the service, the URL, nor how to start it. Pins that a
connection failure becomes an actionable, self-service error.

Fails on main: the message is 'fetch failed'.

Refs #156

* fix(obsidivm): actionable error when the range service is unreachable

The obsidivm:* benchmarks fetch from the OBSIDIVM range service; when it is not
running the bridge's shared call() let the raw 'fetch failed' propagate, which
surfaced as an opaque 'FATAL: fetch failed' (#156) naming neither the service,
the URL, nor how to start it — even in --hunter stub, whose grading step still
needs it. Wrap the fetch in call() (the single choke point for every OBSIDIVM
request) so a connection failure becomes: 'OBSIDIVM service unreachable at <url>
... Start it per docs/OBSIDIVM.md (python3 range.py, listens on :4200), or set
OBSIDIVM_URL', flagged err.unreachable to distinguish it from an HTTP-status
error; a timeout is reported distinctly. Clarify in the bench --help/usage that
every hunter mode (stub included) needs the OBSIDIVM service, live/t3mp3st also
a key. Adds scripts/obsidivm-bridge.d.mts so the new test types cleanly.

Closes #156

* fix(obsidivm): distinguish invalid-URL from unreachable; test timeout path

Adversarial review of the diff found two gaps:
- A malformed OBSIDIVM_URL (ERR_INVALID_URL) was folded into the 'service
  unreachable — is it running?' path, misdirecting the user to start a service
  when the real fix is the URL. Now branched to a distinct 'Invalid OBSIDIVM
  base URL … set OBSIDIVM_URL' error, no err.unreachable flag.
- The timeout (AbortError) branch had no coverage. Added a test using a
  never-responding TCP server + short timeoutMs asserting 'timed out after Nms'
  and NOT unreachable; and a test for the invalid-URL branch.

Also completed the .d.mts stub with the cloudgoat* methods it was missing.

Refs #156

scripts/obsidivm-bridge.d.mts

@@ -0,0 +1,33 @@
+// Types for the OBSIDIVM bridge client (consumed by the vitest test).
+// Runnable logic lives in the sibling .mjs (scripts run under bare `node`, no build step).
+
+/** A network-level failure (connection refused / DNS / timeout) carries this flag,
+ * distinguishing an unreachable service from an HTTP-status error (which sets `status`). */
+export interface ObsidivmError extends Error {
+  unreachable?: boolean;
+  status?: number;
+  body?: unknown;
+}
+
+export interface ObsidivmClient {
+  readonly baseUrl: string;
+  health(): Promise<unknown>;
+  getSpec(): Promise<{ version?: string; targets?: Array<{ id: string; name?: string; port?: number }> } & Record<string, unknown>>;
+  status(): Promise<unknown>;
+  deploy(): Promise<unknown>;
+  destroy(): Promise<unknown>;
+  startTarget(id: string): Promise<unknown>;
+  stopTarget(id: string): Promise<unknown>;
+  scoreText(targetId: string, text: string): Promise<Record<string, unknown>>;
+  createRun(payload?: Record<string, unknown>): Promise<Record<string, unknown>>;
+  attachSession(runId: string, payload?: Record<string, unknown>): Promise<unknown>;
+  proposeGoalposts(payload?: Record<string, unknown>): Promise<unknown>;
+  evolveStart(payload?: Record<string, unknown>): Promise<unknown>;
+  evolveStop(): Promise<unknown>;
+  cloudgoatInstall(): Promise<unknown>;
+  cloudgoatCreate(scenario: string): Promise<unknown>;
+  cloudgoatDestroy(scenario: string): Promise<unknown>;
+  cloudgoatDestroyAll(): Promise<unknown>;
+}
+
+export function obsidivm(opts?: { baseUrl?: string; timeoutMs?: number }): ObsidivmClient;