[3/5] [cloud-config] Add managed-layer wire and cache support

[hefuc-oai]

Summary

• add optional baseline and system-overlay buckets to the backend transport and cloud bundle domain models
• preserve absent versus explicitly empty managed buckets through wire conversion, cache serialization, and emptiness checks
• parse and validate every managed fragment while leaving runtime precedence unchanged
• add per-bucket trace counts and bundle-shape observability
• keep cache v1 and its filename while adding dual-signature compatibility

Cache compatibility

• the existing signature covers a legacy-only projection, so older binaries can still validate and consume the legacy fields written by a new binary
• managed_layers_signature uses a separate domain-specific HMAC key over the complete payload
• new writers always emit both signatures
• managed data is accepted only when the complete-payload signature is valid
• legacy caches without managed data remain readable during this transition

This PR intentionally does not materialize baseline/system-overlay buckets into the runtime config stack. That precedence change is the next PR.

Validation

• just test -p codex-cloud-config -p codex-config -p codex-backend-client -p codex-backend-openapi-models — 231 passed
• just fix -p codex-cloud-config -p codex-config -p codex-backend-client -p codex-backend-openapi-models
• just fmt

The total diff is 789 changed lines, within the repository's 800-line review limit.