feature/https: URL→digest cache index for true zero-network repeat fetches

HTTPS feature cache today is content-addressed by sha256 of the body. To compute the digest we re-download the tarball on every `Fetch` call; only the **extract** step is cached (skipped if `/https/sha256-/extracted/devcontainer-feature.json` exists).

### Plan

Add an `/https/index.json` mapping `URL → {digest, fetchedAt, ttl}`. On Fetch, look up by URL first, validate the cached digest's extracted dir, and skip the download entirely on hit. Honor a default TTL (e.g. 24h) so we still re-pull occasionally for security; configurable via `DiskStoreOptions.HTTPSCacheTTL`.

### Why

For DAP-style hot paths and CI, network round-trips on cached features are wasted seconds. Documented limitation in design/features.md §8 / current code in feature/https.go.