Implement managed cache sets with scoped acquisitions

[flyingrobots]

Outcome

Implement an optional managed cache policy over retention generations with explicit TTL observations, entry and logical-byte limits, deterministic approximate-LRU eviction, bounded inspection, and scoped acquisitions that keep a selected generation retained during use.

Dependencies

• Implement deterministic GC planning and identity-preserving compaction #21 GC and compaction
• ADR: define retention-derived lifecycle surfaces #85 lifecycle-surface ADR
• Implement private named vault and mutable root-set surfaces #92 vault and root-set surfaces

Invariant impact

Cache policy may release retention but cannot alter content identity, bypass reader safety, infer time from ambient clocks in the core, or make an acquired generation collectible before its scope is released.

Acceptance criteria

• Time enters as a validated caller observation under a named policy, never through an ambient core clock.
• Entry and logical-byte accounting use checked arithmetic and exact handle evidence.
• Approximate-LRU ordering is deterministic under identical admitted observations.
• Eviction publishes an exact successor generation and returns immutable retention evidence.
• Scoped acquisition retains the complete selected generation until explicit release or crash recovery disposes its durable scope.
• Inspection and repair are bounded and cannot silently shorten live acquisition or retention windows.
• Model tests cover admission, access, eviction, acquisition, release, stale writers, restart, and GC interaction.
• Benchmarks report policy work, metadata growth, acquisition cost, and retained physical bytes without assigning deduplicated bytes to one owner falsely.

Non-goals

• Wall-clock ownership in Keep core.
• Security replay protection.
• Exact global LRU.
• Treating cache membership as application authority.