Promote public CLI interfaces for artifact restore and response codecs

[mikemol]

Motivation

• Make CLI consumers import only documented/public symbols by promoting several internal underscore-prefixed helpers to public names for artifact restore and response codec concerns.
• Reduce ad-hoc private-symbol imports in cli.py and tests so the CLI surface depends on stable, shared APIs.
• Preserve behavior and compatibility by keeping module-level underscore aliases that map to the new public entry points at the boundary.

Description

• Promoted artifact-restore helpers in src/gabion/cli_support/shared/github_artifact_restore.py by renaming _restore_aspf_state_from_github_artifacts, _NoRedirectHandler, _download_artifact_archive_bytes, and _state_requires_chunk_artifacts to public restore_aspf_state_from_github_artifacts, NoRedirectHandler, download_artifact_archive_bytes, and state_requires_chunk_artifacts, and exported them via __all__ while retaining underscore aliases for compatibility.
• Promoted response codec entry points in src/gabion/server_core/command_orchestrator_primitives.py by exposing normalize_dataflow_response and serialize_dataflow_response (and creating underscore aliases back to them) so CLI code can call public normalization/serialization APIs.
• Updated src/gabion/cli.py to import and use only the new public symbols and to bind local underscore names to the new public functions at the ingress boundary.
• Updated tests to exercise the public APIs and added tests/gabion/cli_support/shared/test_github_artifact_restore.py to validate the promoted artifact-restore interfaces and compatibility aliases, and updated CLI output-emitter tests to use the public codec names; refreshed out/test_evidence.json accordingly.

Testing

• Ran the repository policy checks with PYTHONPATH=.:src mise exec -- python scripts/policy/policy_check.py --workflows and --ambiguity-contract which completed (note: mise warned about remote version metadata resolution but did not block local checks).
• Ran targeted pytest suites with PYTHONPATH=.:src mise exec -- python -m pytest -o addopts='' tests/gabion/cli/cli_helpers_cases.py and PYTHONPATH=.:src mise exec -- python -m pytest -o addopts='' tests/gabion/cli/cli_output_emitters_cases.py tests/gabion/cli_support/shared/test_github_artifact_restore.py, and all tests passed (145 collected across targeted runs; focused runs passed).
• Ran evidence extraction PYTHONPATH=.:src mise exec -- python -m scripts.misc.extract_test_evidence --root . --tests tests --out out/test_evidence.json and updated out/test_evidence.json to include mappings for the new tests.

---

Codex Task