Wraps devagentic's ``fetchUrl(url, ctx_id?) -> JSON`` mutation as
an MCP tool. Last G2 sub-issue — closes the #56 G2 parent roadmap.

## Implementation

- ``plugins/devagentic-mutations/client.py::fetch_url(url,
  ctx_id=None)`` — thin GraphQL wrapper.
- ``mcp_serve.py::_register_devagentic_mutation_tools`` — registers
  the ``fetch_url`` MCP tool.

## Devagentic-side constraints (surfaced through the wrapper)

- **localhost-only**: URL must start with ``http://localhost`` or
  ``http://127.0.0.1``. Resolver raises ``ValueError`` otherwise.
- **16K body cap**: bodies larger than 16K are truncated; response
  carries ``truncated: true``.
- **Mock-shape integration**: ``DEVAGENTIC_MOCK_LOOKUP=true`` (env
  default) consults stored mock shapes before the network call;
  ``DEVAGENTIC_MOCK_CAPTURE=true`` (env default) memoizes 200
  responses post-fetch. Tool surface unchanged — workers see
  ``mocked`` + optional ``mock_source_doc`` flags in the response.

## Tests

- 5 new client-level tests in tests/plugins/devagentic-mutations/
  test_client.py: empty-url fail-soft, happy-path round-trip,
  null-ctx_id wire shape, mock-lookup round-trip, non-dict
  response fail-soft.
- Contract test in tests/test_mcp_defensive_registrars.py extended:
  ``fetch_url`` added to required-G2-tools set (now 15 named tools).
- 195 total green across affected suites — no regression.

## #56 G2 parent closes with this ship

| Sub-issue | Tool | Status |
|---|---|---|
| #60 G2b | assert_output | ✅ |
| #61 G2c | read_artifact + preview_patch + patch_artifact | ✅ |
| #62 G2d | fetch_url | ✅ this PR |