feat(sample): arcli sample {list,show,load} for real datasets

[xe-nvdk]

Summary

• Adds arcli sample list | show | load so a new user can put real data into their own Arc instead of writing one synthetic point and wondering what Arc is for.
• sample load citibike downloads a month of NYC Citi Bike trips (31 files, 39.4 MiB, 1,003,770 rows), verifies every file against the published SHA-256, imports it, and prints two queries worth running against what just landed.
• sample show citibike -o json prints every file URL and checksum, so anyone who would rather not fetch from us can download the data themselves and use arcli import parquet.
• Datasets come from samples.basekick.net, the only Basekick-controlled host arcli contacts. Requests carry the same User-Agent and Arcli-Installation-Id as every other arcli request (the existing DO_NOT_TRACK / send_installation_id opt-outs apply) and never the token, the Arc endpoint, or anything about the user's data.
• The README previously claimed "arcli never contacts Basekick or any third party." That is no longer true; the Privacy section now says exactly what is sent, including that fetching a file reveals your IP to whoever serves it.

Behaviour worth knowing

• Creates the target database if absent; asks before adding to a measurement that already holds rows, so a second run cannot silently double the counts the printed queries report (--yes skips it, and a non-TTY refuses rather than hanging).
• Interrupted downloads resume: a file already present with a matching checksum is not re-fetched; a mismatch is deleted and re-downloaded once before failing.
• --download-only needs no Arc connection at all.
• Import is admin-only server-side, so the preflight runs before any bytes are downloaded.

Review findings fixed before this PR

The internal deep review found two things that mattered, both fixed here:

• Fetch had no fail-fast. An unrecognised build 403s on every part, so a user would have waited through 31 failures. A failure now cancels the rest: 4 requests instead of 31. Regression-tested.
• Progress could print 31/31 downloaded on a run that then failed, because the counter incremented on errors too. It now counts only successes.

Also fixed: a goroutine leak on early return (stragglers could write into a directory the command had already deleted), manifest validation for empty part keys / negative sizes / colliding basenames, three independent timeouts converged onto --timeout, and a generic query fallback so a future dataset does not silently ship without the payoff.

One process note: my first fail-fast test passed while the code was broken and failed once it was fixed — it was measuring its own sleep, not the cancellation. Caught only by running it. Both regression tests are in the permanent suite.

Test plan

• gofmt -l ., go vet ./..., go test -race -count=1 ./... — all clean
• Live arcli sample load citibike against a local arc serve: 31/31 files, checksums verified, 1,003,770 rows imported in ~3s
• Both printed queries pasted verbatim into arcli query — correct results (top station W 21 St & 6 Ave, 4,070; commute curve peaks 08:00 / 17:00)
• Second run detects existing rows, prompts, and refuses cleanly in a non-TTY
• --download-only with no Arc configured; --download-dir re-run reports 31 cached, zero re-downloads
• Configuration matrix: no config file, --token without --endpoint, --endpoint only (auth disabled), ARC_ENDPOINT, -c missing connection, -o arrow, DO_NOT_TRACK=1
• Installation id verified on the wire for both the manifest fetch and part downloads; Authorization never sent to the sample host
• Every flag documented in the README verified to exist on the binary