Cooldown hides the version from metadata but still serves the tarball

[oscar-broman]

A version inside the cooldown window is removed from the packument, but the artifact endpoint downloads it anyway.
So npm ci, which reads tarball URLs straight from package-lock.json, bypasses the cooldown.

Repro

test-config.yaml

listen: "127.0.0.1:37771"
base_url: "http://127.0.0.1:37771"
storage:
  path: "/tmp/cooldown-bug/artifacts"
database:
  driver: sqlite
  path: "/tmp/cooldown-bug/proxy.db"
cooldown:
  default: "0"
  packages:
    "pkg:npm/left-pad": "36500d"

test-cooldown.sh

./proxy serve -config test-config.yaml &
sleep 2

curl -s http://127.0.0.1:37771/npm/left-pad | grep -c 'left-pad-1.3.0.tgz'
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:37771/npm/left-pad/-/left-pad-1.3.0.tgz

kill %1

Result

0
200

Expectation

0
404

Expected 404 on the second one. Change the cooldown to 0d and step 1 prints 1 instead.