Finish cache snapshot contract

[farach]

Summary

• keep the internal archive reader on one acquisition lock from cache resolution or download through receipt verification and private snapshot creation
• parse only the matching private snapshot, clean it on success or failure, and preserve the exported shared-path behavior without requiring a throwaway snapshot
• replace broad credential substring matching with explicit normalized OAuth and cloud parameter names, including camelCase and separator-free equivalents, while preserving benign parameters

Stacked overlap

• PR Honor omitted cache provenance constraints #20 merged into the base while this draft was open. It overlapped NEWS.md, R/cache.R, and tests/testthat/test-panel.R; its omitted version / as_of constraint behavior and tests are retained.
• The live base then advanced to 98ea875 with a direct implementation of the same two findings, overlapping all six files. This draft now integrates that commit and retains only the stricter single-outer-lock acquisition contract, expanded deterministic cleanup and lock coverage, and compatible explicit aliases.

Validation

• devtools::test(): 795 passed
• rcmdcheck::rcmdcheck(args = "--as-cran"): 0 errors, 0 warnings, 1 standard new-submission note
• Rscript tools/validate-clean-install.R --rounds=2: passed
• installed-package tests with network blocked plus installed showcase validation: passed
• pkgdown::check_pkgdown() and full external site build: passed; generated O*NET rendering checked
• workflow YAML parse validation: passed
• hosted CI: no checks scheduled because both workflows filter pull requests to main; this stacked PR correctly targets farach-harden-release-gates

Current head: 6da4e6fd972a086c7b02abdb65c4b4b14f7fef81. Current base: 98ea87519f259a11e26e02f8d8a3eec0a5c958b0. The PR is mergeable and remains draft.

[farach]

Superseded by the current-base implementation already integrated into authoritative draft PR #18. Branch retained for audit; do not delete.

[farach]

Closed again: delayed session instructions reopened this PR after it was superseded. Authoritative decision is final: PR #18 is the sole merge path; this branch is retained only for audit.