perf: avoid redundant blob reads for MST2 HEAD and cached chunks

[Ivanbeethoven]

MST/2 HEAD currently loads and hashes the entire fixed blob, and chunk requests repeat that work before checking an already verified projection cache. Resolve the pinned Git path and current verified size/digest fact first: HEAD returns those headers without reading the body, and map/page/chunk requests load the fixed blob only on a cache miss.

The fixed path and expected digest remain authoritative before cache access. Missing current facts return retryable METADATA_NOT_READY/503 without backfill; malformed facts, body/fact disagreement and incompatible cached projections fail with INTEGRITY_ERROR. Shared path traversal verifies fetched tree identities. Existing raw-body callers retain their required resolver.

Eleven new regressions use real isolated database schemas, LocalObjectStore body-read counters and routed HTTP requests for HEAD, cold/warm aliases, frames, missing/corrupt facts, database/backend failures, auth/lease checks, and old-SID stability. Complete source and stack-propagation reviews pass.

Validation at 5ab8e6f: new exact-head native gates are pending. The fixture performs a real n=1 trunk push through enqueue, claim and B3 execution, and verifies its native publication certificate before initial resolve. The old-SID case also advances /project through real publication and confirms the changed global head before its original HEAD/map body-read assertions. Complete source, fixture and stack propagation reviews, nightly formatting, locked offline metadata, whitespace checks and exact frozen source identity pass. The private-module import caught on the prior 4084 head is corrected to the public config::PushPolicy export; that head executed no test suites.

The previous a6c0ce7 run failed all eleven new cases at initial resolve because initialization alone left the native head INITIALIZING; it did not execute their body-read assertions. This repair retains publication_enabled and all production guards, original body counters and error assertions. Earlier-head green jobs are not this head's validation.

Stacked on #53, including upstream main 2fe6801 through ordinary merges. Latency and memory improvements have not been measured. Cold projection still holds a full Vec, and bounded range storage, response streaming, continuous policy checks and durable runtime retention remain separate work.