feat: add RubyGems registry support

Summary

Re-submission of #43 (Matt Van Horn's RubyGems registry support), rebased onto current main with the remove.rs fix the review bot flagged on the original PR, plus two follow-on fixes surfaced during review.

Adds gem:, ruby:, and rubygems: prefixes to fetch Ruby gem source code via rubygems.org API. Same shape as npm, PyPI, and crates.io.

Usage

opensrc path gem:rails
opensrc path ruby:sidekiq
opensrc path gem:nokogiri@1.16.0

Also adds --rubygems to opensrc clean and shows RubyGems in opensrc list.

What changed vs #43

• Rebased onto current main. #56's structured-error refactor (April 30) replaced Box<dyn std::error::Error> with the crate's typed Error/Result across all registries. rubygems.rs now uses Error::PackageNotFound, Error::HttpStatus, and Error::NoRepoUrl to match the other registry modules.
• Resolved the list.rs conflict introduced by #53's opensrc fetch subcommand. The empty-state hint uses fetch examples to match the post-#53 style.
• Added Registry::RubyGems to the fallback registry scan in remove.rs, the issue the review bot flagged on #43. Without it, RubyGems packages could only be removed by an explicit gem: prefix.
• Tightened the remove.rs prefix scoping. The cross-registry fallback now only fires when the user did not supply an explicit prefix, so opensrc remove gem:rails no longer risks deleting a cached npm/PyPI/crates rails when no gem rails is present. Added a was_explicit: bool field to DetectedRegistry to carry the prefix information out of detection.
• Collapsed the rubygems.rs error variant. The single-call V2 endpoint can't distinguish "gem missing" from "version missing", so a misleading VersionNotFound was replaced with a single PackageNotFound reporting the user's spec verbatim.

Known limitations (out of scope here)

Three concerns surfaced during review that exist in current main for every registry, not just RubyGems. Flagging for maintainer visibility; happy to open separate PRs if helpful:

1. Substring-based host validation. is_git_repo_url in core/registries/mod.rs uses url.contains("github.com"), and authenticated_clone_url rewrites credentials via str::replace. A malicious package whose repository URL contains a known host as a substring (e.g. https://github.com.evil.example/owner/repo) passes validation and would receive GITHUB_TOKEN. Fix: parse with url::Url and require exact host match.

2. Default-branch fallback silently mislabels cache. clone_at_tag in core/git.rs treats a tagless default-branch clone as success after v{version} and {version} both miss. sources.json then records the package at the requested version while the cache holds default-branch HEAD. RubyGems is more likely to hit this than npm/crates because gem repos don't uniformly tag with the v prefix.

3. URL encoding inconsistency. npm.rs encodes package names with urlencoding::encode; pypi.rs, crates.rs, and this PR's rubygems.rs interpolate raw. Probably benign for the constrained name characters these registries allow, but worth aligning.

Testing

cargo fmt --manifest-path packages/opensrc/cli/Cargo.toml --check
cargo clippy --manifest-path packages/opensrc/cli/Cargo.toml -- -D warnings
cargo test --manifest-path packages/opensrc/cli/Cargo.toml -- --test-threads=1

All 107 tests pass. fmt and clippy clean.

Credit

Original work by @mvanhorn in #43. The squashed commit keeps Matt as Author. I'm listed as Co-author for the rebase, error-pattern port, remove.rs scoping fix, and error-variant collapse.

This PR was AI-generated and human-reviewed. The rebase, error refactor, and remove.rs fixes were prepared with Claude Code under my review, with adversarial review from Codex and Gemini before submission.