refactor(npm): unify dist-tags and packument inline-build singleflight

Summary

Follow-up to !625 (merged) (surfaced in that review): the dist-tags (internal/format/npm/disttags.go) and packument (internal/format/npm/packument_get.go) GET handlers carried diverged copies of the cache-miss inline-build singleflight. This unifies them behind one shared implementation so they cannot drift again.

Changes

• New internal/format/npm/inline_build.go:
  • collapseInlineBuild[R] — the shared singleflight.Do wrapper: owns the context.WithoutCancel + inlineBuildTimeout detach, the shared-result assertion, and the collapse-counter increment.
  • inlineBuildKey(ns, pkg, kind) — one collapse key (replaces dist-tags' 2-arg inlineBuildKey and packument's singleflightKey); kind is now a parameter so kind=0/1/2 never collapse onto each other.
  • inlineBuildTimeout — one shared 30s bound (was two identical consts).
• packument now captures singleflight's shared bool and increments a new packument_inline_build_collapsed_total counter (twin of dist-tags'), registered in RegisterMetrics — a stalled packument collapse rate is now alertable, not silent.
• Both builds already detached the leader context; the detach now lives only in the shared helper.

Behaviour-preserving for responses; the only new output is the packument collapse metric.

Testing

• go build ./..., go vet (default and -tags integration)
• golangci-lint 2.12 — 0 issues
• npm unit suite with -race; scoped DistTags|Packument integration tests
• Added: packument collapse-metering (+N) assertion, a solo-build negative, and a kind-distinctness case on inlineBuildKey

Related to #217 (closed)