cacher: add 'docker download --pull' and silence cobra usage on errors

* docker download --pull: on cache miss, falls back to docker pull
  + docker save + S3 seed, mirroring the --url fallback on file
  download. Collapses the if/else cache-or-pull bash dance in CI
  manifests to a single command.

* SilenceUsage on rootCmd: cache-miss / key-not-found exits aren't
  bad-usage errors, so the cobra Usage block dump on every error was
  noise. Short error line remains.

Initial cacher v0.0.1-dev — S3-backed CI cache helper

Replaces tarantool-protobuf/.builds/lib/ci-lib.sh (and its
two shell helpers s3_cache_or_curl + s3_cache_docker_image)
with a single static Go binary.

Commands:
  init / doctor          persist config + smoke-test credentials
  download / upload      single-file cache with URL fallback + sha256
  exists / list / delete cache management
  key                    resolve key template (for shell scripting)
  docker {exists,download,upload}  streamed save/load via zstd
  dir {download,upload}            tar+zstd directory caching (new)

Key derivation via --hash-from <path> (repeatable; file or dir),
matching the existing sha256sum | cut -c1-16 shell convention.
Garage-compatible S3 client (path-style, checksums when_required).