Artifact CAS: cache existence checks for already-uploaded evidence #3543

When chainloop attestation add uploads evidence that is already in the CAS, the Artifact CAS still does the full backend work on every call. It reads the backend credentials from the secrets manager, builds a new storage client, and asks the storage backend whether the blob exists. This makes repeated uploads of the same evidence slow, and it adds load on the secrets manager and the storage backend.

Blobs in the CAS are content-addressed and cannot be deleted through Chainloop, so a positive "exists" answer stays valid. The Artifact CAS can cache it for a bounded time and answer later uploads of the same digest without a call to the backend.

Scope:

• Cache positive "exists" results in the Artifact CAS, scoped to the organization and the CAS backend.
• Reuse backend credentials and clients for a short time, so cache misses are cheaper too.
• Use the existing cache abstraction: shared NATS KV when the CAS has a NATS connection, in-memory LRU otherwise.

A design spec will follow in docs/specs/.