Implements P1.1 of SHIP-TWO-001 §26.8 stack-tool-extension chain. Extends
`apr pull` with the dataset asset-type per `apr-cli-pull-dataset-v1.yaml`:

    apr pull dataset <REPO> [--include <GLOB>] [--revision <REV>] [--output <DIR>]

Backward-compat preserved: `apr pull <MODEL>` model path unchanged.

## What this enables

P1 of the corpus pipeline (codeparrot/github-code-clean → 1B+ Python tokens
→ MODEL-2 convergence) is gated on this. Stack-canonical workflow replacing
the route-around `huggingface-cli download --include` muda flagged in §26.8.

## Implementation

- **commands_enum.rs**: New `Pull` fields — `repo: Option<String>`,
  `include: Vec<String>`, `output: Option<PathBuf>`. Discriminates on first
  positional == "dataset" (per contract: "asset-type is a positional
  discriminator, not a flag").
- **dispatch.rs**: Routes to `pull::run_dataset(repo, include, revision, output)`
  when first positional == "dataset"; else falls through to existing model
  puller.
- **commands/pull_dataset.rs** (NEW, 196 LOC): Lists files via HF API
  `/api/datasets/{repo}/tree/{rev}?recursive=1`; filters by glob patterns;
  fail-fast on no-match; streams matched files via existing
  `download_file_with_progress` helper.
- **Default cache**: `~/.cache/aprender/datasets/<repo>/` (or
  `$XDG_CACHE_HOME/aprender/datasets/<repo>/`).

## Falsification verdict (live on noah-Lambda-Vector RTX 4090)

| ID | Rule | Result |
|----|------|--------|
| FALSIFY-APR-PULL-DATASET-001 | --help shows --include | PASS (visible in `apr pull dataset --help`) |
| FALSIFY-APR-PULL-DATASET-002 | include glob filters correctly | PASS (openwebtext --include 'README.md' → 1 file) |
| FALSIFY-APR-PULL-DATASET-003 | no-match exits non-zero | PASS (exit code 5 = ValidationFailed) |
| FALSIFY-APR-PULL-DATASET-004 | license-allowlist filters rows | DEFERRED to P1.1.5 (parquet round-trip required) |
| FALSIFY-APR-PULL-DATASET-005 | model path backward-compat | PASS (`apr pull qwen2.5-coder --dry-run` resolves cleanly) |
| FALSIFY-APR-PULL-DATASET-006 | 3-surface drift gate | PASS (`cargo test cli_commands` 6/6 pass) |
| FALSIFY-APR-PULL-DATASET-007 | pv validate exits 0 | PASS (contract bumped 1.0.0 → 1.1.0 ACTIVE) |
| FALSIFY-APR-PULL-DATASET-008 | no batuta hf pull / huggingface-cli | PASS (no regressions in P1 scripts) |

5 unit tests for `filter_files_by_globs` (empty, glob match, no-match, multi-include
union, invalid glob) PASS.

## Contract bump

- `metadata.version`: 1.0.0 → 1.1.0
- `metadata.status`: PROPOSED → ACTIVE
- `proof_obligations[2].type`: safety → soundness (pv-validator schema fix)
- `proof_obligations[3].type`: liveness → termination (pv-validator schema fix)

## P1.1.5 deferred

License-allowlist row filter (`--license-allowlist <CSV>`,
`--license-column <NAME>`) requires parquet/jsonl row-level filtering — non-
trivial new infrastructure (parquet-rs round-trip, jsonl re-encode). Scoped
out per spec §26.8 acceptable-exception list. Contract retains the equation
specification; implementation tracked separately.

## Files changed

- `crates/apr-cli/src/commands_enum.rs` (Pull variant)
- `crates/apr-cli/src/dispatch.rs` (asset_type dispatch)
- `crates/apr-cli/src/commands/pull.rs` (include!() new module)
- `crates/apr-cli/src/commands/pull_dataset.rs` (NEW)
- `crates/apr-cli/src/lib_dispatch_coverage.rs` (test fixture)
- `crates/apr-cli/src/lib_extract_paths.rs` (test fixture)
- `crates/apr-cli/src/lib_parse_export.rs` (test fixtures, 3 sites)
- `contracts/apr-cli-pull-dataset-v1.yaml` (PROPOSED → ACTIVE 1.1.0)
- `crates/apr-cli/src/lib.rs` (rustfmt-only)
- `crates/apr-cli/src/commands/stamp.rs` (rustfmt-only)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>