Load read-only manifested snapshots with separate writable caches

[flujo-app]

Workers and text peers can now load a complete manifested snapshot from a read-only artifact directory while placing runtime locks in a separate writable cache. --artifact_root R --cache_dir C reaches the actual worker config/block and text-client loaders; the five existing worker placement claims still bind the writable cache and assigned span.

Explicit roots require exactly the declared regular files and their parent directories. Full size/SHA-256 validation runs before construction, rejecting missing/corrupt files, symlinks/reparse points and undeclared loader sidecars. Misses never fall back to Hub or custom HTTP. The adopted opt-in ManifestArtifactVerifier(cache_only=True) separately supports existing verified Hub/custom cache entries; default online behavior is unchanged. Callers maintain the read-only mount. Direct worker/text-peer scope only: drift node does not propagate this flag. Content checks do not grant catalog or execution authority.

Stacked on #38 at 2d08f31aa58c2c7b49304d0367ab51ae9aaccb11; its checkout is untouched.

Validation: 110 passed, 1 deselected, zero skipped across the new constructor-boundary regressions, manifest verifier tests and existing manifest-loader test, using synthetic fixtures only. The deselected test is the loopback HTTP resume case. Black/isort and whitespace checks passed. Independent researcher source review of final head 681deb528a2d83a354a991a032c6ffa8d14a4242 found no concrete blocker and independently confirmed all 42 snapshot tests passed, zero skipped. The supplied root is canonicalized; links/reparse points inside the resolved snapshot are rejected. Hosted CI is intentionally skipped because its macOS gate downloads a real model and runs a swarm, outside this source-only request. No real weights, provider/model execution, keys, catalog refresh, container build or deployment.