bug: malformed GitHub API JSON can crash extension operations

## What happened?

Malformed or truncated JSON returned with HTTP 200 can throw an uncaught exception from the GitHub extension API helper instead of rejecting `fetchJson()`.

In `packages/cli/src/config/extensions/github_fetch.ts:24-57`, response chunks are collected and `JSON.parse(data)` is called inside the response's `end` event callback. That callback has no `try/catch`, so a `SyntaxError` escapes the Promise executor's asynchronous callback. The returned promise is not rejected in a controlled way. The response stream itself also has no `error` listener.

Existing tests cover successful multi-chunk JSON, redirects, non-200 statuses, and request errors, but not malformed JSON or response-stream errors.

## How can this be reproduced?

1. Mock `https.get()` to invoke its response callback with status 200.
2. Emit a data chunk containing `{invalid`.
3. Emit `end`.
4. `JSON.parse()` throws from the event callback rather than causing `await expect(fetchJson(...)).rejects` to pass.

A truncated real response ending after partial JSON has the same behavior.

## What did you expect to happen?

`fetchJson()` should reject with a contextual error for malformed content or a response-stream failure, allowing the extension command's existing error handling to report the failure normally.

## Why this matters

Remote API/proxy failures can terminate an extension command or potentially the CLI process instead of producing an actionable diagnostic.

## Suggested direction

- Wrap parsing in `try/catch` and reject with URL/status context.
- Listen for response `error`/`aborted` events.
- Drain non-success responses where appropriate.
- Add focused malformed-JSON and response-error tests.

## Client information

Found by source audit on current `main`, commit `f47d6c6f7`. This is platform-independent networking logic; `/about` output is not applicable.

Start in packages/cli/src/config/extensions/github_fetch.ts:24-57 and inspect the existing tests for successful multi-chunk JSON, redirects, non-200 statuses, and request errors. Add focused coverage for malformed JSON and response-stream errors, then verify that fetchJson() rejects with contextual URL/status information rather than allowing an asynchronous exception to escape.

Written by the indexing model from the issue text.