fix(io): cancellable OAuth callbacks and atomic cache records

[wolfv]

Stack: follows #199.

• Keep OAuth callback sockets async and bound the total request headers, so the existing deadline cannot be defeated by a partial request.
• Bound token exchange responses/deadlines and redact bearer tokens from Debug/error output.
• Check/remove expired memory entries under one lock.
• Replace filesystem expiration and data together using an existing workspace dependency (tempfile); never unlink a replacement during expiry reads. Reject overflowing TTLs.
• Default filesystem caches to the production namespace. Legacy two-file records are ignored.

Validation: all-feature tests and strict all-target Clippy for sigstore-cache and sigstore-oidc. Regressions cover partial/oversized callbacks, state mismatch, redaction, expiry and concurrent cache access.

[wolfv]

Windows cache tests now pass after handling transient native replacement errors without deleting the old record. The remaining live interoperability failure is Rekor v2 returning HTTP 503 (no healthy upstream); local and other CI checks pass.