fix: sequence passthrough artifact download after producer upload

[joshua-temple]

Problem

A live orchestrate run of cascade-example-2env (run 27626828892) failed: the
matrix image build uploaded its passthrough artifact, but the dependent bundle
build's Download artifacts for Build (bundle) step failed with
Artifact not found for name: build-image.

Root cause is a job-ordering race, not a name mismatch. For a build declaring
artifact: { upload: ... }, cascade emits a sibling <build>-upload job. A
consumer declaring artifact: { downloads: [<producer>] } gets a
<consumer>-download pre-job. That pre-job's needs: was
[setup, <consumer direct deps>] and never included <producer>-upload, so the
download ran before the upload finished. The run log confirms the ordering: the
download attempt at 14:59:45 failed eight seconds before the upload even started
at 14:59:53. The artifact name matched (build-image); the artifact simply did
not exist yet. A consumer depends_on would not help, because it only sequences
the consumer after the producer callback, which can finish before its separate
upload job does.

Fix

writePassthroughDownloadJob now adds each producer's <producer>-upload job to
the download pre-job's needs: (deduplicated, and only when the producer
declares an upload). This establishes the missing happens-after edge so the
artifact exists before the download runs.

Before:

build-bundle-download:
  needs: [setup]

After:

build-bundle-download:
  needs: [setup, build-image-upload]

The diff against the real 2env manifest is exactly this one line.

Verification

• Failing-first generator test
  TestGenerator_PassthroughArtifact_DownloadNeedsUploadJob reproduces the
  defect (matrix producer, consumer with no depends_on, mirroring 2env) and
  asserts the download job's needs: includes build-image-upload. Red before
  the change, green after.
• go build ./..., go test ./... (1357 pass), and golangci-lint run ./...
  all green.
• Regenerated 2env locally before/after: the only change is the added
  build-image-upload edge on the bundle download job.

No e2e scenario was added. The e2e harness BuildConfig does not expose the
artifact passthrough field (e2e/harness/scenario.go), and the act runner is
started with no artifact server (e2e/harness/act.go), so upload-artifact /
download-artifact cannot execute under the harness at all. The race only
manifests at runtime with a real artifact backend. The deterministic generator
test on the emitted needs: ordering plus the live 2env run are the appropriate
coverage.