v0.50.1

fix: move download outside global lock in CacheAndUnpack (#551)

## Summary

- Move the network download step outside the global file lock in
`CacheAndUnpack()` so slow downloads no longer block other hermit
processes
- Only the fast local extract + link operations remain under the lock,
preventing "timed out acquiring lock" errors in CI
- Consistent with `CacheAndDigest()` which already downloads outside any
lock

This is safe because cache paths are content-addressed (SHA256-based)
and the cache layer uses temp files + atomic `os.Rename` (see
`cache/http.go` `downloadHTTP()`).

per
[ADR-0098](https://docs.google.com/document/d/1CxeLv3gArVytK8pJLw-MMA3t6j4OqE65rK1Kbs6RcrM/edit)
and the [Workspace
Contract](https://docs.google.com/document/d/18Susz4iTeWoINhchvIFmSen_fHU657hAurvNlZFliuY/edit).

## Test plan

- [x] \`go build ./...\` compiles successfully
- [x] \`go test ./state/... ./cache/...\` passes
- [ ] Verify in CI that parallel hermit installs no longer produce lock
timeout errors

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>