Harden Skippy layer-package materialization cache

[IvGolovach]

Summary

Skippy layer-package stages now materialize into the local derived-stage cache with a stronger cache-safety contract.

• Adds a materialized-cache sidecar that binds a derived stage artifact to the request identity, manifest SHA, selected package parts, and final output metadata.
• Serializes writers for the same materialized output with a per-output advisory lock.
• Uses unique cache-owned staging paths so concurrent materialization attempts cannot collide on the same temporary file.
• Validates the staged GGUF before publishing it as the final derived artifact.
• Keeps cleanup paths honest by removing the sidecar record when derived stage artifacts are pruned or deleted.

Why

The risky part of layer-package transfer and reuse is not only whether package artifacts are downloaded correctly. The final materialized GGUF is also a cache boundary: if it is reused after a partial write, concurrent publish race, stale final artifact, or mismatched package identity, Skippy can silently load the wrong derived stage.

This PR makes that boundary explicit. A materialized stage is only treated as reusable when its sidecar still matches the current request, manifest, selected artifacts, and output metadata. Otherwise Skippy rematerializes instead of trusting a valid-looking file path.

Implementation

• Extracts materialized stage cache handling into a dedicated skippy-runtime module.
• Adds MaterializedCacheIdentity records for request identity, manifest SHA, and selected artifact path/size/SHA data.
• Adds per-output locking around the reuse/write/publish sequence and rechecks the cache after acquiring the lock.
• Writes materialization output through .staging/ with unique names rather than pid-only temp paths.
• Publishes only after the staged GGUF opens successfully through the runtime metadata reader.
• Exposes the sidecar path to host-runtime cleanup so cache records do not outlive the artifact they describe.

Compatibility

• No mesh gossip, peer protocol, plugin protocol, or API contract changes.
• Existing materialized .gguf files without sidecar records are treated as cache misses and rebuilt when needed.
• Layer-package manifest and artifact verification behavior is preserved; this adds a second safety boundary around the derived materialized output.

Validation

Local validation passed with LLAMA_STAGE_BUILD_DIR set to the local stage ABI build directory:

• git fetch --no-tags origin main:refs/remotes/origin/main
• git diff --check
• git diff --cached --check
• cargo fmt --all
• cargo fmt --all -- --check
• cargo test -p skippy-runtime --lib materialized_cache - 3 passed
• cargo test -p skippy-runtime --lib package::tests - 15 passed
• cargo test -p skippy-runtime --lib - 36 passed
• cargo test -p mesh-llm-host-runtime --lib materialized_stage_preview_matches_source_removal_candidates - 1 passed
• cargo test -p mesh-llm-host-runtime --lib inference::skippy::materialization::tests - 16 passed, 2 ignored
• cargo check -p mesh-llm

Not run: just build - not required for this Rust-only runtime/cache change; no UI, bundle, or release artifact changed.

Remote CI will provide final PR-sha proof after the PR is opened.

Rollback

Revert this PR. Existing package artifacts and source model caches are not migrated by this change.

Related

Follow-up to the Skippy layer-package / HF cache-safety discussion around #471 and #485.