The single-request reader is public: _get becomes fetch_document

[ChelseaKR]

What was wrong

_get carries the whole of what this module promises about somebody else's server:

• HTTPS only;
• an honest User-Agent, and a refusal to send a blank one;
• a hard stop on 401, 403 and 429, with the landing page named;
• a non-JSON answer read as a challenge page rather than parsed;
• an error payload refused rather than treated as data.

It was private, so the only way for a consumer to have those five was to write them again. wildfire-service-territory-overlap did, for months, and its docs/UPSTREAM.md names the reason in exactly those terms:

The refusals inside the copied _get ... still exist twice, because fetch_feature_pages still needs a fetch upstream does not expose.

#84 and #86 closed the walk half of that: that project now pages every layer through iter_features and its copy of the offset rule is gone. This is the other half. Without it, the next thing that project needs to read — the item metadata behind a territory layer, to answer "has the publisher moved since the pin" without downloading 180 MB to find out — either writes a sixth copy of the refusals or reaches for a private name.

What changed

_get → fetch_document, public, with a docstring saying what it is for and what it is not: one request, no paging, and a caller reading a layer still wants iter_features, whose offset rule is the thing that must not be copied.

Rename only. No behaviour changed and no signature changed.

How it was verified

make verify green in full, determinism gate included. The 62 tests in tests/test_acquire.py pass with every assertion unchanged — only the name they substitute moved — which is what a rename should look like and is the reason no negative control is offered here: there is no new branch to break, and a sabotage of the refusals would only re-prove tests that already existed and already pass.

The one thing worth checking about a rename is that nothing still calls the old name, and nothing does: a word-boundary search for _get across src/ and tests/ returns only fake_get and counting_get, the test helpers.

Prepared with AI assistance; reviewed before submission.