feat(prefetch): replay an ordered warm set before builds

[jleni]

Problem

Automatic build-start prefetch begins only after compilation has started, so speculative downloads race demand from the first compiler invocation. The remaining P4a outcome in #583 is an explicit pre-build head start using durable ordered session data.

Proposed solution

Add an explicit kache prefetch workflow that:

• selects the latest compatible ordered warm-set manifest for the repository, target, toolchain, profile and build shape;
• downloads through the existing per-entry remote pipeline;
• skips entries already present locally;
• honors key, byte, concurrency and wall-time budgets;
• optionally installs an explicit, idempotent and removable post-checkout/post-merge hook.

Hook installation must remain opt-in. A missing remote or compatible manifest must be a safe, explained no-op.

Acceptance criteria

• remote: _manifests/ overwrites per target triple and save-manifest destroys build order (blocks session replay) #582 first preserves ordered, append-only session manifests.
• A producer build can publish a compatible ordered warm set.
• After wiping the local store, kache prefetch restores that set with bounded work.
• The following qualified build obtains local hits with zero compiler runs for restored units.
• Incompatible toolchain, target, profile or build-shape manifests are rejected.
• Partial download failures are summarized and never corrupt an existing local entry.
• Hook install/uninstall is idempotent and never edits unrelated repository hooks.
• E2E coverage proves wipe-and-rehydrate behavior without fixed sleeps.

Dependencies

• remote: _manifests/ overwrites per target triple and save-manifest destroys build order (blocks session replay) #582 — durable ordered session manifests.
• prefetch: P0.5 telemetry cannot compute byte precision or blocking time #618 — trustworthy byte-precision and blocking-time measurement.
• fix(prefetch): bound and back off cargo metadata discovery #698 — bounded metadata discovery where workspace inspection is needed.

Non-goals

• Hosted-service learning or HA.
• Warm bundles.
• Automatic hook installation.
• C/C++ build enumeration.