test: cover the cap's storage and npm arms, part 2 of 3 (upload-session-concurrency-cap plan: 11/12)

Adds the storage, npm and composition-root test functions part 1 deferred. No production line moves here: the diff is eight files, seven of them test files. The eighth is internal/storage/metrictest/metrictest.go, a test-helper package that gains a gauge reader.

Part 2 of a three-MR stack. Part 1 (!2882 (merged)) and the plan amendment (!2881 (merged)) have merged, and this MR targets main.

Merge order

Merge this MR, then !2884 (merged), which targets this MR's branch.

What it covers

The admission integration suite (internal/storage) drives the store against a small gate and asserts the shed sentinel, the counter delta on the asking site's own admission_source, that a shed inserts no upload_sessions row, that a shed observes no hold, and that the unit comes back on every path past the acquire: the upload-id failure, the INSERT failure, the staging-writer failure, Close, Cancel, a dead caller context and a handler panic. A covered open's release is checked too: it must free nothing, or the holder's own release panics on an over-release. The waiter-admitted criterion stays with the gate's own synctest case.

The npm rebuild covers the two-unit pre-acquire, its shed, the release when the two-unit window fails at the first open, the render, the fence at the stamp, the upsert, the commit, and the second open with both refusal kinds, the dist-tags session holding exactly one unit on a store that charges it and giving it back when its write or its stamp fails, and the rendering ceiling clamped from the derived cap.

The npm publish window covers the release on the three returns the committed flag skips, the deferred Session.Cancel running while the unit is still held, a handler panic, and a client hangup.

The composition root asserts by identity that the store factory and the rebuild are handed the gate wireStorage returns, and that the rendering ceiling is sized from the configured cap rather than a constant.

Size

1,617 reviewable LOC (+1,583/−34), past the 500-LOC ceiling. All of it is test code.

Group	Files	LOC
storage	upload_admission_integration_test.go 524, metrictest/metrictest.go 50, export_test.go 42	616
npm	packument_cache_internal_test.go 494, publish_stream_integration_test.go 315, packument_cache_shed_internal_test.go 63, export_test.go 9	881
cmd	wire_storage_test.go	120

Why not split: the three groups share no fixtures, so a split by package is possible. But npm alone is 881, so a split by package still leaves one part past the ceiling, and it adds two more MRs to re-stack !2884 (merged) on. Review of this diff is also already in progress. The growth since the first round comes from the failure rows and release cases review asked for.

Verification

At this branch's head: go vet clean untagged and with -tags=integration; golangci-lint 0 issues untagged; golangci-lint --build-tags=integration reports nothing on the lines this MR adds. The unit suites and the integration-tagged internal/storage and internal/format/npm suites pass against a local PostgreSQL and Redis. The new release checks were each confirmed to fail under the mutation they target: the rebuild pair released only on success or booked below the first open, the dist-tags release moved ahead of the write or called only after a clean stamp, a covered open that frees a unit, and a publish release skipped on panic or hangup. The publish commit-failure row also fails when it is driven into the streaming failure that answers the same 500.

Related to #1035