refactor(rootfs): split the entry cache into cache.rs

The cache stopped being an implementation detail of the rootfs
lifecycle: entry naming, the advisory lock, digest freshness,
provisioned-layer pointers, and extraction-to-scratch are a store
in their own right. cache.rs now owns RootfsCache's paths, pointers
and extraction products; rootfs.rs keeps the lifecycle API
(PrepareRequest, PreparedRootfs, prepare, prepare_provisioned).
resolve_source moves next to its inputs in distro. Pure movement -
naming still derives its extension from the URL, next commit
changes that.

crates/ecrou-cli/src/main.rs

@@ -37,7 +37,8 @@ fn cmd_provision(
     command: &[String],
     cli_verbose: bool,
 ) -> std::process::ExitCode {
-    use ecrou::rootfs::{PrepareRequest, RootfsCache};
+    use ecrou::cache::RootfsCache;
+    use ecrou::rootfs::PrepareRequest;
     use ecrou::spec::ProvisionSpec;
 
     // Two shapes: `provision IMAGE -- COMMAND` bakes a one-off
@@ -251,7 +252,7 @@ fn cmd_probe() -> std::process::ExitCode {
     }
 
     print!("cache:        ");
-    match ecrou::rootfs::RootfsCache::default_dir() {
+    match ecrou::cache::RootfsCache::default_dir() {
         Ok(dir) => {
             // The run flow creates the cache on demand; probe mirrors it.
             if let Err(err) = std::fs::create_dir_all(&dir) {