fix: serialize artifact cache upload and commit for the same entry

[hamodywe]

upload and commit both close their database handle before touching storage, so nothing prevented a commit from finalizing a cache -- and, on cleanup, deleting its temporary chunk directory -- while a concurrent upload for the same cache ID was still writing into that directory. Depending on timing this drops or corrupts the uploaded bytes, or causes the in-flight upload request to fail outright.

Add a per-cache-ID mutex (cacheLock) and hold it for the full check-then-write sequence in both handlers, so upload and commit for the same cache ID are now mutually exclusive while unrelated cache IDs remain fully concurrent.

TestHandler_UploadCommitRace uses a small test-only hook to force the exact interleaving deterministically rather than relying on winning a nanosecond-wide race by chance: it pauses upload right after its completeness check, starts a concurrent commit, confirms commit cannot finish while upload holds the lock, then verifies the committed artifact matches exactly what was uploaded. Reverting just the lock (keeping the hook) makes this test fail every time with "commit finished while upload still held the cache lock", often alongside a connection reset on the upload request itself -- confirming both that the race is real and that the test catches it.

fixes #6012

[hamodywe]

Closing this to keep my open-PR list honest - no hard feelings, I know maintainer time is the scarce thing. The branch stays on my fork, so if this is ever useful just say the word and I'll reopen it.