apt: stream cache-miss pool/** downloads to the client instead of fetching the whole file first

Reported by a colleague: a 308 MB plasma-workspace-wallpapers .deb through snapcraft/LXD failed with 502 'origin fetch failed: context canceled' after ~30s, while wget (long read timeout) succeeded in 38s.

Cause: on a pool/** cache miss the proxy downloads the whole body into the store and only then starts the response (docs/design.md §8 says it streams; the code does not), so time-to-first-byte equals the full origin download time. A client with a ~30s no-data timeout hangs up, and because the fetch ran under that client's request context, the download is cancelled and discarded, so every retry restarts from zero and can never finish.

Plan:

• origin fetch runs detached from any one client (survives disconnects, always ends up cached)
• response headers are sent and flushed as soon as the origin's arrive; the body is streamed while it is hashed and stored; concurrent requests (and Range resumes) tail the in-progress object
• ObjectWriter may optionally implement io.ReaderAt to expose pending bytes (fslocal, memstore)
• tests: first byte before origin completes, client disconnect still caches, concurrent tailing, Range during fill, hash mismatch, origin failure mid-body; plus an exploratory check against a slow origin
• update design.md §8, NEWS