Add RRCC local closure metrics

[jerenkrantz]

Summary

• detect Bazel synthetic remote repository-contents cache entries
• validate their marker, Tree, and nested file closure against local cache state
• return ActionCache NotFound for an incomplete local closure so Bazel re-evaluates the repository rather than failing on a lazy file read
• expose fixed-cardinality RRCC closure metrics and logs

This correctness-first mode intentionally treats remote-only RRCC content as a miss. Remote S3 presence checks are out of scope for this PR.

Validation

• go build ./...
• go vet ./...
• go test -race ./...
• golangci-lint run --max-issues-per-linter=0 --max-same-issues=0 ./...