cache: load parent chain only once in remote cache LoadWithParents

[ljluestc]

cache: load parent chain only once in remote cache LoadWithParents

Fixes #2184

Problem

When a remote cache match is found, cacheManager.LoadWithParents loads not only the matched record but every
parent record as well, so that cache metadata is saved for all parent layers and a later build with only loca
cache can still get a partial match.

In cacheResultStorage.LoadWithParents (cache/remotecache/v1/cachestorage.go), each of those records was loaded with its own worker.FromRemote call. Every parent record's solver.Remote contains the full descriptor chain
from the root up to that record, so each call verified (Provider.Info) and loaded (GetByBlob) all the layers below it again. For a chain of n layers this is n + (n-1) + ... + 1 = O(n²) layer verifications. The checks
are cheap in the common case, but noticeable for large images, and expensive in the moby integration where verification of existing layers goes through the download manager and touches the local disk.

Approach

The key observation is that every record collected by the walk passes isSubRemote(subRes.Result, result.Result), i.e. its remote is a strict prefix of the matched result's remote. So there is no need to load each prefix independently:

1. During walkAllResults, only collect the (record id, remote) pairs instead of loading them.
2. Call worker.FromRemote once for the matched result's full remote.
3. Take each record's ref from the returned ref's LayerChain() (ordered root→top): a record whose remote has k descriptors gets chain[k-1].Clone().

Each layer is now verified and loaded exactly once — O(n) — while the results map handed back to the solver is unchanged, so cache metadata is still recorded for every parent record.

No function signatures change, and no state needs to be threaded through the solver: the "parent already loaded" state the issue mentions is exactly what the loaded ref's layer chain already represents.

Safety fallback

If a worker ever returns a ref whose layer chain does not map 1:1 onto the remote's descriptors, the affected records fall back to the previous per-record FromRemote call, so behavior is preserved for non-standard workers.

Also fixed

The old code did m[id] = worker.NewWorkerRefResult(...) for every matching result of an item, overwriting earlier entries for the same id without releasing them — a ref leak. Overwritten entries are now released.

Testing

• go build ./cache/... ./solver/... ./worker/... — clean
• go vet ./cache/remotecache/v1/ — clean
• go test ./cache/remotecache/... — v1 and registry pass (TestGhaCacheIntegration fails without an integration environment, both before and after this change)
• go test -short ./solver/ — pass