feat(lfs): add FastCDC media transport

[marshawcoco]

Summary

• connect Libra's existing frozen fastcdc-v1 chunker, manifest, and local chunk store to normal LFS push/download flows
• negotiate the repository-scoped Mega media extension while preserving standard LFS fallback before a chunked transfer is selected
• upload only missing chunks, resume interrupted transfers, reuse verified cached chunks, and repair corrupt cache entries
• fail closed on authentication or integrity errors after selecting a finalized manifest
• derive repository-scoped LFS URLs without dropping paths, query strings, ports, or IPv6 hosts
• atomically publish hydrated files after whole-object verification
• flush ordinary LFS downloads and checksum-error pointers before returning, fixing an observed Tokio write-completion race
• document the opt-in configuration, authentication flow, behavior, and known production gaps

This is the client half of a coordinated Mega server change. Mega companion PR: gitmono-dev/mega#2178

Verification

• cargo test --features fastcdc --test compat_fastcdc_feature_gate_guard: 2 passed
• cargo test --features fastcdc --test media_fastcdc_test: 6 passed, 1 interop case ignored
• cargo test --features fastcdc --lib utils::media::: 12 passed
• default and FastCDC checks passed; the FastCDC release build passed on Windows/MSVC
• the ignored Libra-to-Mega HTTP case passed against the companion Mega production routes and test fixture
• cargo +nightly fmt --all --check, git diff --check, and a Playwright 1.62.1 Chromium install dry-run passed after repairing the self-hosted Web E2E workflow

The PR also removes Playwright's per-job --with-deps invocation from the self-hosted Web E2E job. The runner must provide its Linux browser dependencies; the old command attempted interactive sudo and had timed out for five minutes across multiple unrelated PRs before any E2E test ran.

cargo test --features fastcdc --lib completed with 4,196 passed and 98 failures in non-FastCDC Windows-sensitive areas. Those failures were not individually proven to be baseline failures because the clean-baseline comparison was itself blocked by unguarded Unix-only test code. The two --all runs and strict all-targets/all-features Clippy were also non-zero on Windows. This PR does not claim full CI is green.

Deployment boundary

The feature is disabled by default and can be disabled per repository with lfs.fastcdc=false. The HTTP fixture uses loopback, an injected test client/token, SQLite, and Local object storage. It does not validate production credential storage, a complete Mono deployment, S3/GCS backends, shared repository ACLs, quotas, or garbage collection.

CI follow-up — 2026-08-31

Follow-up head: 5d0becc4ad06db957654a61182fe83cd75b8c9f2 (signed and pushed). The earlier verification results above are historical; they are not a fresh full-suite or HTTP interop result for this head.

• CI on 9a0530b77 failed compat-offline-core (9,182 passed, 22 failed). Local fixes address 16 failures: restore host-only HTTP remotes' root LFS endpoints, repair the five-column media grading row, and register the interop test's cwd serial lane. Local checks passed: existing sub-face tests 4/4, extracted production URL functions and existing tests 3/3, serial annotation guard 1/1, and fmt/diff checks. The real CLI lock tests still need a newly built binary and remote rerun; the exact serial registry guard remains affected by Windows path separators locally.
• The other six mv/status failures coincide with the self-hosted runner's newer global-config schema. Relevant files are unchanged against the tested merge parent, but clean-baseline reproduction has not been performed; runner configuration contamination remains the working diagnosis.
• The Web E2E bootstrap-token export is fixed locally; five scenarios executed through the actual workflow loop passed. Remote Web E2E still needs rerunning.
• RISC-V CI repeatedly failed during pnpm dependency installation, before Rust compilation or tests; no RISC-V FastCDC result is claimed.

Fresh cargo check --features fastcdc --lib --test media_fastcdc_test --test compat_fastcdc_feature_gate_guard -j 1 passed on Windows (24 warnings retained). This is not a test execution or strict Clippy result.

As of 2026-08-31 10:35 +08, the new head has 1 successful, 1 neutral, 2 failed, 4 running and 4 queued checks. rustfmt job 99363858524 failed downloading nightly metadata with tls handshake eof; the formatter itself was skipped. A normal job rerun request returned HTTP 403 (Must have admin rights to Repository), so a maintainer must rerun it. RISC-V job 99363858175 again failed installing Web dependencies: pnpm 11.10.0 reported tarball extraction errors and an invalid numeric src argument importing @noble/ciphers; Rust build was skipped. The runner/package-manager environment needs investigation. Other checks have not finished. The production and cloud-storage validation boundaries above are unchanged.

Final merge update — 2026-09-01

Merged into main as 1a590b6af1c755f847717db4477fc2153964f8bf. Before merge, maintainers rebased the branch onto dad35f23 and rewrote the final PR head to 2f790f7f25f54655f187c04ba898f8378940f810; the FastCDC implementation and tests were preserved.

• all 11 reported final checks succeeded
• compat-offline-core: 9,257 passed, 3 skipped; all 13 prior LFS lock regressions and both FastCDC feature-gate tests passed
• the final base had temporarily removed the Playwright Web E2E job and RISC-V workflow, so those two surfaces were not part of the final 11 checks; they must not be counted as final-head passes
• the production and cloud-storage boundaries above remain unchanged

The companion Mega PR #2178 is also merged.