fix: use callable type for injected fetch

[rksharma-owg]

What changed and why

Replace typeof fetch at fetch-injection boundaries with a focused FetchLike callable contract. Current Node 24 typings add a static preconnect member to typeof fetch, so the cert-aware async wrapper no longer satisfied that platform-specific type and clean builds failed with TS2741.

The new type captures only the request call signature used by CVE Lite. It is threaded through the advisory, scanner, multi-folder, registry, and CLI injection points without changing runtime behavior. A regression test verifies that OSV scanning accepts a callable implementation with no preconnect static member.

Validation:

• npm test -- --runInBand — 101 suites, 1,180 tests passed
• npm run build — passed, including distribution checks
• git diff --check — passed

Closes #885