fix: harden clob download error handling

[krowvin]

Summary

• keep default blob/clob downloads on safe relative paths when IDs start with / or \
• fix CLOB download/list scoped-read hint handling so HTTP failures report the intended access hint
• avoid showing CDA credential-scope hints for local filesystem write/path failures
• log the actual blob download path after extension detection

Why

Blob and CLOB IDs can look like paths, but default downloads should never write to filesystem root. Local destination failures should point users toward --dest, while real CDA HTTP failures can still show credential-scope guidance.

Validation

• poetry run pytest tests/commands/test_download_dest_safety.py tests/commands/test_blob_upload.py tests/commands/test_clob.py -q
• poetry run pytest -q
• poetry check (warnings only for existing Poetry metadata deprecations)