Build bounded Detail decode and cache core

[OliverZhaohaibin]

What changed

• Rebuilds only the Detail transaction, request scheduler, platform still decoders, surface cache, and render-state coordinator from [Parity remediation in progress] Enhance startup pipeline and optimize photo album management #890; no merge commits, Edit, Live Photo, Recognition, or Pets code is included.
• Adds AssetSourceIdentity.has_stable_revision and worker-side stat repair. Legacy identities bypass both reusable memory and disk caches.
• Makes disk hits perform header/key/geometry checks synchronously while payload checksums run on the cache worker; failed validation deny-lists/evicts the entry so the next request re-decodes.
• Writes QImage payloads through a buffer view instead of allocating a same-sized Python bytes object.
• Batches disk pruning by write count, accumulated bytes, or elapsed time.
• Bridges RAW ndarrays through a target-sized view and predicts peak decode memory; full demosaic downgrades to half when the configured working budget would be exceeded.
• Adds Linux/macOS/Windows Detail core contract jobs.

Review remediation

Addresses #890 findings 7 and 9, plus the RAW intermediate-memory portion of finding 8. PlayerView-wide surface retention and Edit/Library lifecycle remain intentionally scoped to the later Detail/Edit/Library replacement PR.

Validation

• Detail core contracts: 64 passed, 1 Windows-only skip locally.
• Full non-GUI regression: 1822 passed, 12 skipped.
• Architecture checks: passed.
• compileall, workflow YAML parse, and git diff --check: passed.
• Cache contracts include a 64 MiB synthetic write without Python bytes, asynchronous disk-hit checksum, 100-write batched pruning, source replacement invalidation, stat-failure bypass, and RAW budget fallback.

Split context

Replacement PR 3 for draft #890. Depends only on merged #891 and #892. The modules are kept independent of Edit and Live Photo UI lifecycle so those behaviors can be reviewed and rolled back separately.