feat: replace primp with webclaw-tls, bump to v0.3.0

Replace primp dependency with our own TLS fingerprinting stack
(webclaw-tls). Perfect Chrome 146 JA4 + Akamai hash match.

- Remove primp entirely (zero references remaining)
- webclaw-fetch now uses webclaw-http from github.com/0xMassi/webclaw-tls
- Native + Mozilla root CAs (fixes HTTPS on cross-signed cert chains)
- Skip unknown certificate extensions (SCT tolerance)
- 99% bypass rate on 102 sites (was ~85% with primp)
- Fixes #5 (HTTPS broken — example.com and similar sites now work)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/webclaw-fetch/src/error.rs

@@ -1,11 +1,11 @@
-/// Fetch-layer errors. Wraps primp/network failures into a single type
+/// Fetch-layer errors. Wraps HTTP/network failures into a single type
 /// that callers can match on without leaking transport details.
 use thiserror::Error;
 
 #[derive(Debug, Error)]
 pub enum FetchError {
     #[error("request failed: {0}")]
-    Request(#[from] primp::Error),
+    Request(#[from] webclaw_http::Error),
 
     #[error("invalid url: {0}")]
     InvalidUrl(String),