imagecache: Pin a pull's layers so eviction cannot retire them mid-pull - #1509

ensureLayer and retireLayer shared one singleflight key per layer, and
that sharing was the retire/reuse interlock: reuse refreshed the layer's
mtime inside the flight, retirement re-checked it inside the same flight.
But a caller whose Do joins a flight rather than leading one runs no
closure and learns nothing about what it joined. When the flight was a
retirement, ensureLayer returned the layer path anyway, which the rename
had just moved aside. The pull recorded a layer with nothing behind it,
and its final re-verify failed a healthy pull with "layer dir vanished
during pull". The window is microseconds wide, so it surfaced only as a
rare failure under load.

Protect a pull's layers the way a cache shrinker protects objects in use,
with a count of current users rather than a lock. A pull pins each of its
layers before any layer work and unpins when it returns. retireLayer
checks the pin and the mtime and renames under the same mutex, and never
retires a pinned layer: either the pin lands first and the retirement is
vetoed, or the rename lands first and the pull finds the dir missing and
unpacks it again. Retirement no longer touches the layer singleflight, so
every flight a pull can join is another pull's ensure, whose result it
can trust.

The pin map holds only layers in use by in-flight pulls and drops entries
at zero. The pin is taken per pull, outside the flight, so a pull that
joins another's flight is covered by its own pin once the leader's lapses.

This changes what happens to a wedged pull. Its record still ages out
after min-age, but its finished layers now stay until the pull returns,
instead of being retired while the download is still running and failing
the pull at its re-verify.

A pull pins every layer before any of them is unpacked, so a pinned
layer with no dir under its final name is one still unpacking, not one
already removed. retireLayer reported it gone, so while every layer only
a record referenced was still downloading, an eviction pass deleted that
record, and if the pull then failed the layers it had finished had no
record until the next pull of that image or the startup orphan sweep.

Such a layer is now vetoed in retireLayer and dryRunRetire, which keeps
the record for the pull the same way a landed pinned layer does. The pin
check for a missing layer reads the map under pinMu; the fresh-layer
fast path still stays off the lock.