fetchFromUpstream read every upstream response fully into memory before
storing and serving it, so a large blob (or several concurrent ones) could
OOM the process. Immutable artifacts now stream through the tempfile-backed
CAS (tee to sha256 + S3), keeping memory bounded regardless of size, and
are served back from the store. Mutable indexes are small and may be
rewritten, so they keep the in-memory path. Immutable content is never
rewritten in the proxy path (proxyBaseURL is empty), so skipping
RewriteResponse there is behaviour-preserving.
Refs #66
unkinben