GeezerVison

Registries such as GitHub Packages publish tarball URLs ending in a content hash, which the proxy cannot parse as a package version. Rewrite these to conventional proxy filenames and resolve the original dist.tarball URL from upstream metadata on an artifact cache miss.

Reuse the metadata fetch for cooldown checks, preserve signed query strings, and require tarball URLs to stay within the configured registry origin and base path. Missing or unusable metadata falls back to the conventional download URL. Cached artifacts remain available without fetching metadata when the publish time is already stored or cooldown is disabled.

Replaces #238 and addresses its outstanding review findings.