feat(fetcher): add optional rakers rendering

[chaliy]

What

Add optional browser-rendered fetch via the render-rakers feature.

Why

Some JS apps, SPAs, and client-rendered docs need a lightweight rendering pass before HTML-to-markdown/text conversion. This keeps the default fetch path unchanged while giving hosts and agents an explicit opt-in.

How

• Add optional rakers dependency behind render-rakers.
• Add per-request render: "rakers" / FetchRequest::render_rakers().
• Add feature-gated ToolBuilder::enable_render_rakers(true) and CLI --render-rakers.
• Run rakers after the normal FetchKit page fetch and before conversion.
• Deny rakers-initiated subresource network requests so they cannot bypass FetchKit egress policy.
• Update README, specs, threat model, maintenance notes, and changelog.

Risk

• Medium
• Optional feature adds dependencies and a lightweight JS execution path, but it is disabled by default and requires both host/tool enablement plus request opt-in.

Checklist

• Unit tests are passed
• Smoke tests are passed
• Documentation is updated
• Specs are up to date and not in conflict
• Security review performed against SSRF/network/resource-exhaustion risks