ANW-43 CLI: add a query subcommand writing the /query JSON offline

The README claims the query engine is available offline, but only the
merge half was: no subcommand produced the path / frontmatter /
last_modified / etag / size projection that GET /query returns.

`anwesen query` takes the same --vault and --query flags as merge and
writes that document to stdout, compact, one line. src/merge.rs becomes
src/oneshot.rs and holds both: one parse-and-load path, so the two
subcommands cannot drift in grammar or in how strictly they read a
vault. cli.rs shares one VaultQueryArgs between them for the same
reason. rfc3339_z moves from http.rs to query.rs, next to the projection
whose timestamp dialect it is.

Assumed a trailing newline on stdout is wanted here even though merge
writes none: the JSON body is one line for jq and shell pipelines, and
the newline terminates it rather than joining the document. Flag if
wrong.

The hurl harness now compares `anwesen query` against GET /query on the
fixture vault for four queries before running the suite, so a drift
between the two surfaces fails CI.

tests/run-hurl.sh

@@ -54,6 +54,20 @@ if [[ $ready -ne 1 ]]; then
     exit 1
 fi
 
+# ANW-43: the offline `query` subcommand must return the document the endpoint
+# returns. Both surfaces read the same fixture vault, so the two outputs are
+# compared byte for byte before the contract suite runs.
+for q in "" "tags=project" "__anw-path=Projects&__anw-limit=1" "status__exists=true"; do
+    cli="$("$BIN" query --vault "$VAULT" --query "$q" --log-level error)"
+    http="$(curl -sf "http://$HOST:$PORT/query?$q")"
+    if [[ "$cli" != "$http" ]]; then
+        echo "anwesen query and GET /query disagree for query '$q'" >&2
+        echo "  cli:  $cli" >&2
+        echo "  http: $http" >&2
+        exit 1
+    fi
+done
+
 # Run every *.hurl. Glob into an array so we can fail loud if there are none.
 shopt -s globstar nullglob
 files=("$ROOT"/tests/hurl/**/*.hurl)