Function fetch_and_validate_client_metadata 

pub async fn fetch_and_validate_client_metadata(
    cache: &DocumentCache,
    url: &str,
) -> Result<ClientMetadataDocument, CimdError>

Production entry point: single-flight-locked cache lookup (including a short negative-result cooldown for cached failures), else SSRF-validate the URL shape, resolve+validate DNS (for domain hosts) or use the already-validated IP literal directly, fetch via fetch_via_pinned_address, and cache the result either way.

Errors

Propagates CimdError from any of the composed validation/fetch steps.