Write the manifest object before the tag and the referrer link

[EricAndrechek]

Problem. For a manifest pushed by digest or by a mutable tag, putManifestInner wrote the manifest-by-digest object, the tag and the referrer link (<repo>/_referrers/<subject>/<digest>) concurrently. If storage refused the manifest write (for example, a transient R2 error) while the link or tag write succeeded, the link or tag named a manifest that doesn't exist. A client that follows referrer links then waits indefinitely for the missing manifest.

Fix. Await the manifest-by-digest write first. The tag and referrer-link writes start only after it has succeeded. If the manifest write fails, nothing that names it is written, and a retried PUT (every write here is write-once) completes all three. The immutable-tag branch already ordered its writes this way and is unchanged.

Tests (test/r2-write-order.test.ts), for each push style (mutable tag, immutable tag, by digest):

• A referrer PUT whose manifest write throws rejects and leaves no referrer link and no tag. Retrying it succeeds and writes the manifest, the link and the tag.
• A successful referrer PUT writes exactly the manifest, the link and (if any) the tag.
• The previous test asserting that the tag and digest writes start concurrently is replaced by one asserting that the digest write finishes first.
• With the concurrent write restored, the failed-manifest tests fail for the mutable-tag and by-digest styles.

The suite goes from 125 to 131 tests; typecheck, eslint and prettier are clean.