feat(maven): step 14 part 2 — fill a kind=2 artifact cache miss through the shared flight

What

Replace the fillRemoteArtifact 501 stub with the cache-miss arm of the artifact read path: an uncached primary file re-reads the cache row, fetches through one per-repository remote.SingleFlight, and streams the upstream body to the client while the fetch pipeline fills the cache. The fill's own 503s derive Retry-After from health_check.scheduled_interval (rounded up, S13) and a propagated upstream 503 relays the upstream's own Retry-After.

Ships the seam the stale arm (next part) also consumes:

• mavenRemoteFlights — the per-repository flight holder with its idle sweep, the flight-scoped request builder, and the cache store.
• the RemoteUpstream / RemoteCredentials / RemoteResolution / UpstreamRetryAfter Deps fields and their wiring.
• the serveRemoteCacheRow extraction, shared by the hit path and the fill's fresh-race serve.

Covered: the cold-fill header subset, Range-on-miss answered 200 full-body, HEAD-on-miss drained then served from the committed row, single-flight coalescing and leader-failure propagation, Basic auth on the wire, and the miss-side error mapping. A stale row still answers the not-implemented 501 the stub did — revalidation lands in the next stacked part.

Related to #286 (closed)

Diff size

~2,750 added lines across 22 files, past the 500-line review threshold. The bulk is the fill arm itself (internal/format/maven/remote_artifact.go, ~800) and its wire-level integration suite (internal/format/maven/remote_artifact_integration_test.go, ~1,280), plus the flight holder's unit tests (~160). This is the second of two stacked parts; a further split would land the fill arm without the integration coverage that proves the one-upstream-GET coalescing the arm exists for, so the test corner must ship with the code.

Testing scenarios

No docs/testing/ catalog change: remote (proxy/cache) Maven repositories are marked out of scope in docs/testing/e2e/maven.md until S14 ships, and this MR is one step of S14. The fill behavior introduced here is pinned by the integration suite (internal/format/maven/remote_artifact_integration_test.go).

Conformance

Not run: the hermetic end-to-end proxy harness (Step 18) is not yet landed, so there is no runnable conformance surface for the artifact fill. The wire shapes are pinned by the integration suite and the S14 error-mapping table in docs/specs/S14-maven-remote.md.

Review note

Stacked on top of mkhalifa/maven-remote-step-14-part1; merge bottom-to-top.