cmd: add --exec fallback and --optional to the download commands

--exec generalises the existing --url (file) and --pull (docker)
fallbacks to anything expressible as a shell command: on a cache miss
the script runs through sh -c and whatever it produced seeds the cache.
That collapses the restore-or-build if/fi block CI manifests repeat
around every cache into a single invocation.

The destination directory is created before the script runs, so the
script needs no mkdir -p of its own. The seed upload stays best-effort
(the content is already on disk), but a failing script is fatal and
propagates its own exit status rather than a generic 2. For docker the
tag is verified with docker image inspect afterwards — with a
best-effort upload, a script exiting 0 without building the image would
otherwise pass silently and fail a later task.

--optional turns a cache miss into exit 0 for download and dir
download, so set -e manifests drop the trailing || echo "cache miss".

Initial cacher v0.0.1-dev — S3-backed CI cache helper

Replaces tarantool-protobuf/.builds/lib/ci-lib.sh (and its
two shell helpers s3_cache_or_curl + s3_cache_docker_image)
with a single static Go binary.

Commands:
  init / doctor          persist config + smoke-test credentials
  download / upload      single-file cache with URL fallback + sha256
  exists / list / delete cache management
  key                    resolve key template (for shell scripting)
  docker {exists,download,upload}  streamed save/load via zstd
  dir {download,upload}            tar+zstd directory caching (new)

Key derivation via --hash-from <path> (repeatable; file or dir),
matching the existing sha256sum | cut -c1-16 shell convention.
Garage-compatible S3 client (path-style, checksums when_required).