calm-hub: getFileAtVersion silently serves HEAD content mislabeled as a historic SHA on a non-200 response

`GitHubVersionService.getFileAtVersion` returns `null` on a non-200 API response (rate limit, transient network error, unknown SHA). Callers that treat `null` as "fall back to the local HEAD clone" then silently serve current HEAD content back, labelled as the historic version the caller asked for — no way to distinguish "this is really version X" from "the fetch for X failed and this is HEAD".

**Fix**: throw a checked exception on API failure instead of returning `null`, so callers can decide whether to surface an error rather than silently substituting HEAD.

(Independent security review finding on #3066, Fable.)

Start at GitHubVersionService.getFileAtVersion and trace the callers that interpret a null result as a fallback to the local HEAD clone. Confirm the non-200 API paths involved, then make API failure distinguishable from a missing historic version so callers can decide whether to surface an error rather than label HEAD content as the requested SHA.

Written by the indexing model from the issue text.