fix(build): validate project finalizer caches

[imathwy]

Summary

• accept the exact schema-3 per-project finalizer cache layout used by remote project jobs
• keep writable branch/project finalizer dependencies content-hashed while preserving the immutable branch-cache fast path
• bound and no-follow metadata reads, document the cross-SDK contract, and add legacy/configured/project regression coverage

Failure reproduced

The Algebraic Topology canary failed before doc-gen with managed Lake cache has an unsafe namespace layout; the cache copy and 12,693-artifact synchronization had succeeded and no OOM occurred.

Validation

• capability SDK suite: pass (build 69, deploy 138, plus common/verso/graph/comparator suites)
• repository suite: 50/50 pass
• SiFlow suite including producer-to-consumer contract: 175/175 pass
• Ruff, format, py_compile, bash syntax, and diff checks: pass
• independent review: no blocker/high/medium after writable branch-finalizer handling was added