#3161 GCS datastore: implement fetchContent, a read of one remote file that writes nothing locally

Problem

Core is adding an optional fetchContent method to the datastore sync contract (swamp-club#3159): return the bytes of one file as the remote holds it, or null when it is absent, and write nothing to the local cache. swamp serve needs it to check that a suspended run's cached record still matches the remote before it resumes the run by itself (swamp-club#3108).

The extension already has the read in fetchForeignContent, but that method builds the key as namespace, slash, relPath with no guard. With an empty namespace the key gets a leading slash (or a doubled slash after a configured bucket prefix), which is a different object, and the lookup returns null as if the file did not exist. So it cannot serve a datastore with no namespace, which is the default.

Proposal

Implement fetchContent(relPath, options, signal) in the cache sync service:

• Reject a relPath that is absolute or contains a dot-dot segment, as fetchForeignContent does.
• Build the key as namespace, slash, relPath when options carries a namespace, and as relPath alone when it does not.
• Return the object's bytes, or null for a not-found error. Any other error is thrown.
• Write nothing to the local cache or the index.

Acceptance

• fetchContent returns the remote bytes for a namespaced and an un-namespaced datastore, with and without a bucket prefix.
• A missing object returns null; an access or network error is thrown, never reported as null.
• Nothing under the cache path changes when it is called.
• The extension passes core's conformance test for the method.

Upstream repository: https://github.com/systeminit/swamp-extensions

Environment

• Extension: @swamp/gcs-datastore@2026.10.06.1
• swamp: 20261007.191647.0-sha.ff3e576c
• OS: linux (x86_64)
• Deno: 2.9.7
• Shell: /usr/bin/zsh