fix(component-runtime): ArtifactCache::install drops the verification error of a damaged cached object #909

ArtifactCache::install (cache.rs) checks an existing object with if destination.is_dir() && let Ok(cached) = self.verify_cached(..) and discards the Err. A cached object whose library digest, size, manifest digest or signature no longer matches is then treated as absent: an offline cache returns ComponentError::Offline { .. } ("component x is not cached and network access is disabled"), an online one silently re-downloads and replaces it (install_stream removes the destination).

Consumers cannot tell "never installed" from "installed and damaged", cannot say which check failed (digest mismatch, bad signature, edited component.json, truncated library), and cannot log or report a repair. Reproduced in poly 0.34.0 (flip a byte in the cached dylib; poly components status --verify reports the Offline message).

Requested: (1) a public ArtifactCache::verify_cached(&self, entry) -> Result<CachedArtifact, ComponentError> that never downloads or removes anything, and (2) install returning (or at least exposing, e.g. through a callback or a ComponentError::CachedObjectInvalid { component, source } when offline) the verification error instead of Offline when the object exists but fails verification. poly would then report the real reason instead of inferring "failed verification" from a cached directory plus an Offline error.