add test that hits a live remote repository over http.

this careens a little more out of the reach of even "integration" testing than i'd like but is a spot that really needs to get hit.  wrapping it up to use a localhost url and spin up its own http server would be lovely future work.
fix issue where pulling down a release from a remote repository over dump http transport where the repo had been packed could cause mdm to fetch tags unrelated to the requested release.