fix: cross-link tag manifests to digest keys and add fetch lock to prevent thundering herd

Tag manifests (e.g. library/nginx/manifests/latest) and their sha256-addressed
counterparts were stored at separate S3 keys with no cross-reference, so a
sha256 manifest request always missed cache even when the identical content had
just been stored under the tag key.

After serving any mutable (tag) manifest, compute the sha256 of the response
body and write it under the digest key (manifests/sha256:<hex>) if absent. The
next sha256-addressed pull hits cache immediately.

Also adds a short-lived Redis distributed lock (SET NX EX 30) around upstream
fetches so that concurrent pods racing for the same cold key poll storage for
up to 5 s before issuing a duplicate upstream request, eliminating the
thundering herd on deploy events.

Includes unit tests for both the lock primitives (acquire/release, fail-open
when Redis is unavailable) and the docker proxy behaviour (cross-link written
on tag hit, not written for sha256 requests, lock acquired/released, poll path
serves from cache without upstream fetch, fallback fetch when poll times out).

tests/test_routes.py

@@ -276,7 +276,9 @@ class TestDockerProxy:
         response = client.get("/v2/docker-test/library/nginx/manifests/v1.25.3")
 
         assert response.status_code == 200
-        deps["storage"].upload.assert_called_once_with(deps["storage"].get_object_key.return_value, manifest)
+        deps["storage"].upload.assert_called_once_with(
+            deps["storage"].get_object_key.return_value, manifest
+        )
 
     def test_tag_manifest_digest_key_not_written_when_already_exists(self, client, patched_deps):
         # When the digest key already exists in storage upload must not be called.