Track unflushed catalog entries without duplicating them in pendingShard

[rmanibus]

Context

PackStore.prepareFlushLocked (internal/storelayer/pack.go) writes every
bundled object into two maps:

for key, entry := range s.packKeys {
    entry.PackRef = packRef
    s.catalog[key] = entry
    s.pendingShard[key] = entry
}

pendingShard exists to record which entries have not yet been written to a
shard. It pays for that by holding a second full copy of every entry the run
produced — keys, values and pack refs.

In a heap profile of backup over a 50,000-file tree this is the single largest
allocation in the process: prepareFlushLocked accounts for 51.9 MB flat out of
111 MB live. writeShard then marshals the map into a ~19 MB JSON blob and
seals that into another. Backup's peak RSS at that size is 360 MB against 161 MB
with packfiles disabled.

Related: #436 covers the same duplication on the read path.

Goal

A backup records which catalog entries are unflushed without holding a second
copy of them.

Scope

• Replace pendingShard map[string]PackEntry with a record of which catalog
  keys are unflushed (a key set, or a marker on the entry), reading values back
  from s.catalog at flush time.
• Update writeShard callers to build the shard from that set.
• Keep discardPack correct: it currently removes the failed pack's entries from
  both maps, and must still forget unflushed entries for a pack whose upload
  failed.

Acceptance Criteria

• Entry values are stored once per run, not twice.
• Shard contents are unchanged for a given sequence of writes.
• discardPack still forgets every entry pointing at an unwritten pack, so a
  failed upload cannot leave the catalog asserting objects are stored.
• go test ./internal/storelayer passes, including the existing pack durability
  and upload-failure tests.
• golangci-lint run ./internal/storelayer/... passes

[rmanibus]

Note after #444 merged: pendingShard picked up a second job, so this issue's
scope is now larger than "stop storing entries twice".

loadCatalogLocked gained a deferred rollback. On any load failure,
resetCatalogAfterLoadFailureLocked rebuilds s.catalog from pendingShard:

func (s *PackStore) resetCatalogAfterLoadFailureLocked() {
	catalog := make(map[string]PackEntry, len(s.pendingShard))
	for key, entry := range s.pendingShard {
		catalog[key] = entry
	}
	s.catalog = catalog
	s.mergedIndex = make(map[string]bool)
}

That is what discards partially-streamed remote entries while keeping the
authoritative ones — locally written by prepareFlushLocked, or recovered from
a pack footer by rebuildFromPacksLocked, both of which write to pendingShard
as well as catalog. So pendingShard is now the record of which entries are
authoritative, not just which are unflushed.

Replacing it with a key set still works, but the replacement has to answer the
rollback's question, not only the shard writer's: given a catalog that may
contain half-decoded remote entries, which keys survive. A key set referencing
s.catalog cannot do that on its own, because the entries it would point at are
exactly the ones that may be untrustworthy.

The invariant the rollback depends on — that pendingShard covers everything
locally added to catalog — currently holds only because Flush clears
pendingShard after ensureCatalogLoaded has succeeded, and the rollback
cannot fire once catalogLoaded is true. Worth pinning that with a test before
restructuring, so the replacement is checked against it rather than against the
shard-writing path alone.

Alternatively #440 may dissolve this: if partial decodes never reach s.catalog
in the first place, the rollback has nothing to restore and pendingShard goes
back to being purely a flush concern. Worth deciding the order of #437 and #440
before starting either.