Report cached versions pending cooldown eligibility

[andrew]

With a cooldown policy enabled, the proxy can contain cached artifacts for versions that are still inside the effective cooldown window. This can happen when a policy is enabled or increased after an artifact was cached. There is currently no way to list those versions or see when they become eligible.

Add a proxy cooldown pending report for distinct version PURLs with at least one cached artifact. A version is pending when its publication time is known and the current global, ecosystem, or package policy does not allow it yet.

Useful output would include:

• version PURL
• publication time
• effective cooldown
• eligibility time and remaining duration
• cached artifact count and total size
• whether direct artifact requests are currently blocked

Support JSON output so the report can feed monitoring and automation. Versions without a publication time should be reported separately as unknown and retain the cooldown library's permissive behavior.

The report depends on resolving several current gaps. Publication-time coverage and cross-registry enforcement can be separate linked issues:

• Base the report on cached artifacts. A version counts as stored only when an artifact has both storage_path and fetched_at; one version can have several artifacts, while a version row alone does not show that its bytes are stored.
• Persist publication times consistently. The normal artifact cache write creates or updates the version row without published_at. npm download checks and enrichment can fill it, but many cached versions have no timestamp. Registry metadata processing should save publication times where available, with a lookup or backfill path considered for existing rows.
• Return the full cooldown evaluation result. Current handlers call IsAllowed, which discards the effective duration and eligibility time needed by the report.
• Apply cooldown checks consistently to cached downloads. Cooldown hides the version from metadata but still serves the tarball #239 added download-time checks for npm and PyPI, while the shared artifact cache lookup has no policy check. Cargo, Composer, Conda, RubyGems, Hex, NuGet, Pub, and cached Helm chart paths can reach cached artifacts without the same evaluation. Tests should enter through each public artifact endpoint with an artifact cached before the policy changes.

This is the proxy counterpart to git-pkgs/git-pkgs#353, which reports pending registry releases for dependencies in a repository. The proxy report covers artifacts already held by the proxy.

The current behavior was checked against proxy main at 8d3dacf. To reproduce the reporting gap:

1. Cache an artifact through the proxy.
2. Configure a cooldown that places its version inside the waiting period.
3. Run proxy stats or inspect the API and version page.
4. The cached version is visible, but its pending state and eligibility time are absent.