Fetch one feed over HTTP(S).

Conditional: the ETag and Last-Modified of the previous answer are sent back,
so an unchanged feed costs a 304 and no body. Bounded: a body past
`max-bytes` is refused while it streams, and every request has a timeout.
Redirects are followed, but never from HTTPS down to HTTP.

Deliver new items through hive-ingestor instead of filing notes.

hive-rss never compile-depends on hive-ingestor. Its `rss` source is
registered through hive-spi, and the ingest is started through the host's
`:tools/invoke` runtime port as `memory ingest source`, the same call a
user makes. The ingestor then chunks, embeds and stores each item, writes
its document entry and its KG edges.

File entries into hive memory through the hive-spi IMemoryStore port.

The port upserts and nothing more, so this sink does what hive-mcp's
`memory add` does around it: a content hash, a duplicate check in the
project, the `scope:project:<id>` tag scope filters match on, and an expiry
from the duration. It never throws; every outcome is a Result.

Per-feed state on disk: seen item keys, validators, and when each feed was
last polled. One EDN file, written atomically, readable only by its owner.

A missing or unreadable file is an empty state rather than an error: the
worst case is that items already filed are offered again, and the memory
sink refuses duplicates by content hash.