feat(cas): add content-addressable storage and namespace package (MR 3/5)

Why

Layer 2 (CAS + namespace) of the S12 OCI-local stack. The content-addressable storage abstraction (cas), its filesystem driver for local testing (fsdriver), and the namespace package that authorizes blob and manifest operations against repository scope.

This MR cannot land before MR-2 because:

• format/oci imports cas, fsdriver, and namespace.
• cas defines the blob-write session machinery used by the OCI upload state machine in MR-4.

Issue: #19 (closed) Spec: S12 (already merged via !48 (merged))

Stack and merge order

#	MR	Branch	Targets	Blocks
0	!141 (merged)	19-oci-boilerplate	main	!124 (closed)
1	!124 (closed)	19-oci-foundation	19-oci-boilerplate	!125 (closed)
2	!125 (closed)	19-oci-database	19-oci-foundation	!126 (closed)
3	!126 (closed) ← you are here	19-oci-cas	19-oci-database	!127 (closed)
4	!127 (closed)	19-oci-format	19-oci-cas	!128 (closed)
5	!128 (closed)	19-oci-wiring	19-oci-format	n/a

What's in MR-3

12 files, ~3,000 insertions, all Go code.

• internal/cas/: the content-addressable storage interface set adopted from S06 (MR !108 (merged)): BlobStore (upper, domain-aware), PathResolver (path computation per ADR-008), StorageDriver (lower, generic object I/O), and Session (first-class chunked-upload object with deferred DB persistence on Close()).
• internal/cas/fsdriver/: filesystem StorageDriver impl gated behind //go:build fsdriver. Default go build ./cmd/registry without the tag won't compile (the wiring depends on the tagged package). Forced opt-in prevents the driver from quietly becoming permanent production code.
• internal/namespace/: scope authorization layer. Inspects an authenticated Identity and a target repository scope, returning whether the operation is permitted.

go.mod adds github.com/google/safeopen (path-traversal-safe filesystem ops for fsdriver) and github.com/opencontainers/go-digest (canonical OCI digest type) as direct dependencies.

Test plan

• CI green on this MR (build, vet, lint, unit tests, including the fsdriver-tagged package).
• cas_integration_test.go runs against the postgres service when internal/datastore/** changes (covered transitively).
• go build -tags=fsdriver ./... compiles cleanly (verified locally).
• go mod tidy is a no-op locally.
• !127 (closed) builds cleanly on top of this branch.