fix: avoid stale part downloads during cache merge

[chenrui333]

Summary

Fixes a restore-path race where a cache entry can start streaming parts/* while another restore finishes the background merge and deletes those parts.

Changes:

• verify each expected part object before streaming a parts-backed cache entry
• keep parts for a short grace period after merge and let the existing cleanup job delete them later
• prune stale cache-entry metadata after an object-not-found restore so later restores miss at lookup instead of repeatedly returning a broken download URL
• add stale-cache regression coverage for retained parts and stale metadata pruning

[chenrui333]

cc @LouisHaftmann