feat(cli): bake network features in as defaults; embeddings run last in sync/setup

Model fetching (APPLE_DOCS_FETCH_MODELS, pin-verified), Apple font DMG
downloads, and the Xcode-docs enrich asset download are now default-on at
the CLI with per-run opt-outs (--no-fetch-models / --no-download-fonts /
--no-enrich-fetch); the legacy env vars remain for programmatic callers and
CI, and library-level defaults stay offline so tests never hit the network.
Boolean flags (--beta, --prebuilt, --compact, --skip-semantic, …) are now
registered in the parser so they can't swallow a following positional.

sync gains a final index-embeddings step (incremental, non-fatal) so the
semantic index sees enrich-added pages and consolidate cleanups; setup
moves its semantic build after resources/compaction/profile for the same
reason.