Gantry: 8 - Typed digest-mismatch classification

## Scope

Replace brittle digest-mismatch error classification.

## Problem

`isDigestMismatchErr` uses substring matching. That is brittle and misses real containerd commit precondition errors in some paths, which can prevent provider quarantine for corrupt peer bytes.

Evidence:

- `internal/gantry/mirror/mirror.go:1674`

## Changes

- Replace digest-mismatch substring matching.
- Use `errors.Is(err, digestpipe.ErrDigestMismatch)` for live stream-through errors.
- Also recognize containerd commit precondition failures with `errors.Is(err, cerrdefs.ErrFailedPrecondition)` in the non-live path.

## Tests

- Digest mismatch classification quarantines providers in both live and non-live paths.
- Test against a real containerd-style commit error string or wrapped `ErrFailedPrecondition`, not only the fake store's current error text.

Start at internal/gantry/mirror/mirror.go:1674 and trace isDigestMismatchErr through the live stream-through and non-live commit paths. Add tests showing provider quarantine for both cases, including a real containerd-style commit error string or a wrapped ErrFailedPrecondition, then run the mirror package tests.

Written by the indexing model from the issue text.