feat: harden cache mount lifecycle with guard pins

[MarcoPorcellato]

Summary

• make PreparedCacheEntry clone cleanup and its entry lock final-drop owned;
• revalidate structured repository/cache/artifact mounts at the Docker spawn boundary before any supervisor request;
• add opt-in guard exec pins for exact completed managed-cache sources, held through child cleanup and guard-session release;
• document the cooperative-lock boundary and add a documentation contract test.

This hardens the lifecycle behind the historical fail-closed Docker exit 125 without attributing the disappearing bind source to an unproven actor.

Trust claim checklist

• Public claims in this pull request do not imply:
  • native execution where only contract-level qualification is available,
  • signed identity or full execution attestation when only A0 evidence is present,
  • zero-cost operation or equivalent absolute cost reductions.
• I described any source, runtime, workflow, permission, secret, policy, schema, or dependency impact below; write none only after checking the diff.
• Roadmap text is presented as planned work, not as implemented or qualified behavior.

Impact and rollback

• Runtime or trust-boundary impact: declared cache sources now use the existing advisory entry lock and structured spawn-boundary revalidation. The guarantee is cooperative; undeclared paths and arbitrary privileged same-path replacement remain outside it.
• Dependency or supply-chain impact: none.
• Data, secret, permission, or network impact: no new secret, network, or receipt fields; absolute managed-cache paths remain outside serialized plans and receipts.
• Rollback path: revert the commits in this PR; no cache schema migration or automatic cleanup was introduced.

Evidence checklist

• I listed the exact focused checks run for this diff.
• I ran cargo fmt --all -- --check when Rust files changed.
• I ran the relevant contract tests and recorded any intentionally not-run gate.
• git diff --check passes.
• User-visible changes update CHANGELOG.md — not included in the authorized exact-head branch; this remains an explicit review item.
• New or changed links point to an existing, authoritative target.

Validation notes

• rtk cargo test --test cache_pin_contract: PASS, 1 test.
• rtk cargo test --lib completed_source_pin: PASS, 12 tests.
• rtk cargo test --lib cache::tests: PASS, 30 tests.
• rtk cargo test --bin commit-ci-preflight: PASS, 22 tests.
• rtk cargo test --lib: PASS, 244 tests, 1 ignored.
• rtk cargo test --all-targets --all-features: PASS, 362 tests, 3 ignored.
• rtk cargo test --doc: PASS, 0 doctests discovered.
• rtk cargo check --all-targets: PASS.
• rtk cargo fmt --all -- --check: PASS.
• rtk git diff --check: PASS.
• rtk cargo clippy --all-targets --all-features -- -D warnings: NOT-RUN because cargo-clippy is not applicable to the installed 1.96.0-aarch64-apple-darwin toolchain.
• CCP run, Docker/native qualification, receipt publication, and evidence publication: NOT-RUN.

Exact branch head: 693f93cc50272f1381419ebdb1150c9a08a4a50f.