Add cache management API: List, GC, Purge

[JAORMX]

Summary

Add cache management methods to image.Cache to support the bbox cache CLI subcommand (stacklok/brood-box#84).

• List() ([]CacheEntry, error) — enumerate all cached rootfs entries with digest, size, last-used time, and which image refs point to each
• GC() (int, error) — reachability-based garbage collection: removes rootfs entries not referenced by any ref index entry
• Purge() error — removes the entire cache directory
• LayerCache.Size() (int64, error) — reports total layer cache disk usage

Ref index enhancement

putRef now stores imageRef\tdigest\n (extended format) so List can report human-readable image references. getRef handles both legacy (digest-only) and extended formats for backward compatibility.

Safety

• GC aborts (returns error) if the refs directory exists but is unreadable, preventing accidental deletion of all entries
• pathFor now validates digests and rejects path separators and .. components (defense-in-depth)
• pathFor uses Replace(..., 1) to match dirNameToDigest for symmetric round-trips
• TOCTOU race between GC and concurrent Pull is documented — consequence is a cache miss, not data loss

Test plan

• 99 tests pass (CGO_ENABLED=0 go test -v ./image/)
• GC: removes orphans, preserves live entries, handles multiple refs to same digest, corrupt ref files, non-existent dirs
• List: entries with refs, orphans, legacy ref format, skips non-rootfs dirs
• Purge: removes everything, handles nil cache and non-existent dirs
• Ref format: extended format write/read, backward-compatible read of legacy format
• LayerCache.Size: empty, nil, non-existent, with entries
• Security review: path traversal defense, TOCTOU analysis, symlink handling
• Go quality review: error handling, API design, backward compatibility
• QA review: test coverage gaps addressed

🤖 Generated with Claude Code