refactor: dedupe ecosystem dispatch, telemetry, API client, cleanup, get (#88)

* refactor: dedupe ecosystem dispatch, telemetry, API, cleanup, get/blob helpers

Net ~718 lines removed across six files; all 1308 tests still pass.

- ecosystem_dispatch.rs: macro-extract the 8 per-ecosystem scan blocks
  duplicated between find_packages_for_purls and find_packages_for_rollback;
  share a dispatch_find core with a pypi_merge callback for the only real
  divergence
- commands/get.rs: hoist report_error / print_json / empty_result_json /
  report_fetch_failure / write_all_patch_blobs / vulnerabilities_for_manifest
  / build_patch_record; fold the three CVE/GHSA/PURL search arms into one
  dispatch
- utils/telemetry.rs: replace ~18 hand-built HashMap<String, Value>
  constructions with a fire() helper plus serde_json::json!({...}) literals
- api/client.rs: collapse search_patches_by_{cve,ghsa,package} behind a
  shared search_patches_by_route(route, identifier)
- api/blob_fetcher.rs: derive Default for FetchMissingBlobsResult; share an
  all_failed_result helper for the three mkdir-blocker branches
- utils/cleanup_blobs.rs: unify cleanup_unused_blobs / cleanup_unused_archives
  behind a cleanup_dir(dir, dry_run, is_used) core

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(ecosystem_dispatch): hoist MergeFn type alias for clippy

`-D clippy::type_complexity` rejected the inline fn-pointer signature on
`dispatch_find`'s `pypi_merge` argument. Lift it to a `MergeFn` type alias
shared by `merge_first_wins` and `merge_pypi_qualified`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mikolalysenko