archive: restore trees with read-only directories; bump to 0.2.2

DecodeDir applied each archived mode as its entry landed, so a 0555
directory became read-only the moment it was created and the first file
written into it failed with EACCES. That is not an edge case: the Go
module cache is 0555 directories and 0444 files throughout, and it is the
main thing dir download is pointed at. Build #295 died on the first cache
HIT of the new gomod key, having passed on the miss.

Directories are now created with the owner-write bit forced on and their
recorded mode applied after extraction finishes, deepest-first. Files are
written writable and chmod'ed after the copy, and a read-only file left
by an earlier restore is replaced rather than treated as an error —
re-restoring over a populated module cache is normal in CI.

Both tests fail against the previous DecodeDir with the same 'permission
denied' the build reported.

Initial cacher v0.0.1-dev — S3-backed CI cache helper

Replaces tarantool-protobuf/.builds/lib/ci-lib.sh (and its
two shell helpers s3_cache_or_curl + s3_cache_docker_image)
with a single static Go binary.

Commands:
  init / doctor          persist config + smoke-test credentials
  download / upload      single-file cache with URL fallback + sha256
  exists / list / delete cache management
  key                    resolve key template (for shell scripting)
  docker {exists,download,upload}  streamed save/load via zstd
  dir {download,upload}            tar+zstd directory caching (new)

Key derivation via --hash-from <path> (repeatable; file or dir),
matching the existing sha256sum | cut -c1-16 shell convention.
Garage-compatible S3 client (path-style, checksums when_required).