Use containerd's content store as Racer's disk copy for Gantry - #1111

…g them

… metric

Racer treats a version's content type as immutable and compares it across
pages. Pages read from the local containerd content store cannot know the
registry's Content-Type header, so registry pages now report blobs as
application/octet-stream too, keeping both sources on one version.

Persistence Adapter keeps a cache's pages in Racer memory only and relies on
the origin adapter's local copies. The CRD rejects it together with
passthrough or origin; the authority maps it to the new CacheMode::Adapter
(wire spelling "adapter"), and publications reject it with a native origin.

A pinned page GET with Racer-Source: local asks the origin adapter to serve
the page only from a copy it holds locally, never from its remote source. A
well-framed 404 or 412 is a local miss. The Go SDK exposes the flag as
OriginRequest.LocalOnly and answers a local-only ErrNotFound or
ErrVersionMismatch with 404.

CacheMode::disk() is false for adapter caches as for passthrough. The store
refuses their writes and pending copies, fills never persist or refresh
them, disk lookups and cuFile staging skip them, reads do not spill ahead to
disk holds, prefetch admits them to memory only, and each snapshot purges
their disk records. Unlike passthrough, pages and metadata stay in memory.

On a memory miss, Fill::acquire_once now visits racer-core's local_sources
before the ranked owner walk. For persistence Adapter that is the node's own
origin adapter, asked with a local-only page request
(Origin::local_page_reserved). A hit is encrypted and published to memory
like an origin page; a miss or failure falls through to peers and the remote
origin without origin failure notes or link-health accounting. Both readers
and owners filling for peers take this path.

…gest verification

DELETE /v1/objects/<key> with a strong If-Match drops the version's metadata,
memory pages, queued writes, and disk index entries on this node, then sends a
signed prefetch 'invalidate' action to each page's ranked owners. Receivers
drop local state only and never forward it.

An invalidation of a version on a worker now also forgets every recorded
holder of each invalidated page, so a later fill does not probe holders
for a version the client declared stale.

…er bench

spec.persistence is mutable, so deploy.sh no longer deletes and recreates
the cache when switching between racer and adapter modes.

A holder whose memory copy was evicted asked its local adapter with no
metadata, so an adapter that names objects by metadata (Gantry) could
never serve its durable copy. Owners now forward the reader's opaque
adapter metadata, never authorization, in holder probes, and holders
pass it to their local-only adapter request.

Hash each content store file once, keyed by file identity, before serving
it for a local-only request. Corrupt files are quarantined as local misses
until replaced, so recovery after Invalidate can reach peers or the
registry instead of rereading bad bytes on this node or a remote owner.
A mirror digest mismatch drops the local result so the file is rechecked.
Adds gantry_racer_local_replica_verifications_total{result}.

Racer keys objects by digest alone, so a digest filled through the blob
route was later served on the manifest route as application/octet-stream.
Store application/octet-stream for every kind from both the registry and
local content store, and recover the manifest media type at the HTTP
boundary from the buffered, digest-checked manifest body (mediaType field,
else inferred OCI index or manifest; untypeable bodies get 503 so
containerd falls through to the registry).