control: repo log --ref, repo download, explore !101

The last three reads the web could do and no other surface could.

• repo log --ref <r> — the flag repo tree, cat and blame already take, defaulting to the default branch as before. Browsing a ref and then asking for its history was a move only the browser could make.
• repo download — writes a tar.gz of a ref to stdout, the way release asset get writes an asset. Deliberately not repo archive: that name is the read-only flag, and renaming it would break every script that sets it. The naming collision was the open question on #49; this is the answer I picked.
• explore — the public listing, paginated with the same cursors as the other lists. repo search requires a query, so there was no way to see what an instance hosts without already knowing a name.

Tests cover history diverging by ref, gzip magic bytes on the archive, an unknown ref refused by both, and explore showing a public repo while not leaking a private one.

Left undone deliberately: the web's log and archive handlers still read git directly. Dispatching them needs features these commands don't have — the log page pages by start-sha rather than a count, and archive would need a streaming dispatch. Rushing either would regress the web page or bend the command to fit web presentation, the same trap noted on #47. Recorded rather than half-done.

Full suite green.

Closes #49