atelet: node-local cache for golden snapshots (OnGolden data resumes re-download the golden every time)

Follow-up from the #683 review (https://github.com/agent-substrate/substrate/pull/683): with `onResume.fromData: Golden`, every resume of a Data snapshot downloads the template's golden snapshot from object storage — including **un-pause**, which is meant to be the fast, node-local path. The golden's memory image is the dominant transfer, so this adds significant latency per un-pause. The pre-existing golden-fallback boot (fresh actor, no snapshot) has the same characteristic today.

## Proposal

Cache golden snapshot files node-locally in atelet, content-addressed by the golden snapshot URI prefix (a golden snapshot is immutable once written, and one golden serves every actor of the template on the node):

- On a `DATA_ON_GOLDEN` restore (or golden-fallback boot), download the golden's files once into a shared cache dir (alongside the existing static-files/sandbox-asset cache), then hardlink or copy them into the per-actor restore dir.
- Subsequent restores on the node skip the download entirely.
- Eviction: goldens are per-template-version; an LRU or size cap over the cache dir handles template churn. Invalidation is not needed for a given URI (immutable), only cleanup of unused goldens.

Care points: the restore dir must remain private per actor (cloud-hypervisor demand-pages from it for the VM's lifetime, so hardlinks must not allow cross-actor mutation; and the cache write must be atomic (temp + rename) like the asset cache.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
EOF
)