ingest/ledgerbackend: add LedgerStream streaming ingestion API - #5944

BufferedStorageBackend decompressed every batch into a freshly-allocated
buffer: DecodeAll's destination was pre-sized only from the frame's
FrameContentSize, which streaming-compressed objects omit, so dst stayed
nil and DecodeAll grew the whole output each call. Under parallel
multi-chunk ingest this dominated allocation.

Pre-size the destination from the previous batch's decompressed size when
the frame carries no FCS (batches are similar-sized) so DecodeAll appends
into a pooled buffer; return the original buffer to the pool when DecodeAll
has to reallocate. Also set WithDecoderConcurrency(1): decompress() is
driven serially by the consumer, so a single decode/buffer combo is both
correct and the most memory-efficient choice (concurrency 0 = GOMAXPROCS
kept GOMAXPROCS decoder combos and allocated per-call decode state).

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Resolves Copilot review comments on the LedgerStream PR:

- getLedgerRaw / captive fetchSequence: the "caller must hold lock" docs
  were false for the stream's legitimate single-owner use. Restate as:
  concurrent callers must hold the lock (GetLedger does); a single
  exclusive owner — the LedgerStream — may call lock-free.
- Rename RPCLedgerBackend.fetchSequenceLocked -> fetchSequence (the
  "Locked" suffix is a "lock held" convention, which the stream's
  lock-free call contradicts) and document the same dual contract.
- ledger_buffer: clamp the lastDecompressedSize fallback hint to
  maxBatchObjectSize so a single outsized/corrupt batch can't permanently
  inflate the pooled decompress buffer; mirrors the FrameContentSize cap.
- buffered_meta_pipe_reader: note raw frames are decoded in GetLedger or
  directly by LedgerStream consumers.

Doc/naming + a two-line clamp; no public API or behavior change.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

LedgerStream is the streaming-first ingestion API, but it reads via the
internal lock-free, zero-copy path (getLedgerRaw/fetchSequence) instead of
GetLedger, so the metricsLedgerBackend decorator never sees its reads — a
consumer adopting the streaming API emitted no metrics at all.

Add WithStreamMetrics(registry, namespace) as a per-call StreamOption on
RawLedgers. fetch_duration is timed once in the shared streamRaw skeleton
(the single point all three backends funnel reads through), and the
captive-core suite is registered on the core that call builds via the
backend's own registerMetrics — the same call WithMetrics makes — so both
ingestion APIs emit the identical metric names. The summary definition is
factored into newLedgerFetchDurationSummary, shared with WithMetrics.

Metrics register on the call, so a registry instruments a single RawLedgers
invocation; a second instrumented call panics on duplicate registration.
Uninstrumented calls stay reusable, and the clock is only sampled when
instrumented to keep the per-ledger hot path free of wasted work.

Make CaptiveStellarCore.closed atomic: the captive gauges read the live core
from the Prometheus scrape goroutine (GetLatestLedgerSequence) while the
lock-free reader advances it and Close writes the flag under the read lock —
no single mutex covers all three callers. Caught by a concurrent-scrape test
under -race.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>