Cache verified deployment startup

[wolfy-j]

Summary:

• restore locked deployments in verified-offline mode without Hub resolution or downloads; replacements resolve only against locally installed, digest-pinned module manifests
• make lint and runtime share effective typecheck configuration and content fingerprints so build-stage lint artifacts are directly consumable at v0 boot
• bound persistent disk-cache retention and keep warm lint/runtime reads immutable
• retain live compiled code by registry node lifecycle instead of LRU recency; add/update/delete and dependent invalidation are atomic with compilation
• bound lint concurrency by GOMAXPROCS and preserve content-addressed artifacts across graph rollback
• use go-lua manifest decoder bounds from Fix manifest decoder bounds go-lua#36

Validation:

• make test passes with race detection across the full repository
• make lint passes with zero findings
• 4,000-entry reachable graph: cold lint 15.57s, warm lint 168ms, runtime restoration 444ms, 127.6 MiB peak RSS, zero cache rewrites
• Bee v0 after lint: 1,001 entries, zero Lua typechecks, runtime ready in 2.27s, 304.6 MiB peak RSS, zero cache rewrites
• 1,476-entry application warm lint: 1.34s and zero filesystem writes

Dependency: wippyai/go-lua#36

Not merged.