feat(npm): packument cache rebuilder core (npm hosted step 12, part 4/5)

This change is split into 5 stacked MRs to keep each within review size. Each part targets the previous one (part 1 targets main); review and merge bottom-up, part 1 first.

Part 4 of 5 of docs/plans/2026-05-11-npm-hosted.md — Step 12: packument cache rebuilder (in-process).

Adds the in-process rebuilder in packument_cache.go: the NpmMetadataFileWriter / NpmPackageResolver / NamespaceSlugFinder seams, RebuildPackumentCache (force-expire then re-upsert all kinds and tags), the fire-and-forget enqueueRebuild with a bounded worker budget and singleflight collapse, dependency wiring (SetRebuildDependencies / ClearRebuildDependencies), and the rebuild metrics. In-package unit tests cover enqueue saturation, slot release, and force-expire-before-upsert.

This part is ~969 reviewable LoC: a dependency-forced indivisible feature (the rebuilder core plus its in-package unit tests). It is under the 1000 hard limit but over the 500 review-branch warning threshold, so the review tooling will flag its size — expected for this part, not a defect.

• Plan: docs/plans/2026-05-11-npm-hosted.md
• Spec: S11-npm-hosted

Related to #130 (closed)

Stacked MRs (review/merge bottom-up)

• feat(npm): NpmPackageByID resolver (npm hosted ... (!712 - merged) • David Fernandez • 19.2
• feat(npm): metadata-file write methods (npm hos... (!713 - merged) • David Fernandez, Dzmitry (Dima) Meshcharakou • 19.2
• feat(npm): transactional cache upsert (npm host... (!714 - merged) • David Fernandez, Dzmitry (Dima) Meshcharakou • 19.2
• feat(npm): packument cache rebuilder core (npm ... (!715 - merged) • David Fernandez, Dzmitry (Dima) Meshcharakou • 19.2 👈
• feat(npm): wire rebuild enqueue + tests (npm ho... (!716 - merged) • David Fernandez, Dzmitry (Dima) Meshcharakou • 19.2