feat(cache): add CARv2 manifest DAG backend

[cre4ture]

Summary

• add the opt-in storage-mode: packs CARv2 backend with immutable DAG-CBOR manifests
• discover and merge concurrent manifest heads through the GitHub Actions cache REST API; conflicting Action Results are cache misses
• commit packs before manifests, validate AC closures against restored packs, and expose pack/manifest metrics
• add packed smoke coverage, documentation, reproducible v0.3.0 binaries, and update Go to 1.26.6 for fixed standard-library vulnerabilities

Validation

• go vet ./...
• go test -race ./...
• staticcheck ./...
• govulncheck ./...
• node --test action/*.test.js
• actionlint
• VERSION=v0.3.0 scripts/build-dist.sh
• (cd dist && sha256sum --check SHA256SUMS)

Clean-code review

• publication, manifest encoding, and CAR retrieval have focused responsibilities; the new storage mode is isolated from the existing object backend.