Gantry: 7 - Opportunistic TTL-map eviction

## Scope

Add bounded eviction for in-memory TTL maps.

## Problem

Negative cache and related TTL maps use lazy access-only eviction and can retain entries that are never re-queried.

Evidence:

- `internal/gantry/negcache/negcache.go:115`
- `internal/gantry/negcache/negcache.go:139`
- `internal/gantry/negcache/negcache.go:157`
- `internal/gantry/coldstart/coldstart.go:950-991`
- `internal/gantry/mirror/mirror.go:1716-1744`

## Changes

- Prefer opportunistic sweeps over background goroutines in library types.
- Add `nextSweep` state and sweep expired entries on mutation and occasional lookup.
- Add an optional max-size cap where necessary, evicting the oldest or earliest cooldown deadline first.
- Apply to `negcache.Cache`.
- Fire `OnSize` after sweeps and mutations.
- Apply the same opportunistic sweep pattern to cold-start `honorUntil` and mirror provider-failure maps.

## Tests

- Expired entries are removed on a later mutation/lookup even when the same digest is not requested again.
- Size callbacks observe post-sweep counts.
- Max-size cap evicts deterministic entries.
- Fake clock tests cover negcache, cold-start honor windows, and mirror provider-failure maps.

Start with internal/gantry/negcache/negcache.go at lines 115, 139, and 157, then inspect coldstart/coldstart.go lines 950-991 and mirror/mirror.go lines 1716-1744. Use fake-clock tests for negcache, cold-start honor windows, and mirror provider-failure maps. Done means expired entries are swept after later mutations or lookups, size callbacks report post-sweep counts, and capped maps evict deterministic entries.

Written by the indexing model from the issue text.