[pending-judge] fix(DC-161 r4): address judge r3 blockers

All three r3 blocking issues fixed + polish applied:

- Radicale provision route now FAILS CLOSED (409) unless the target container
  is present, inspectable, and its image matches /radicale/i. Missing
  containerId, failed inspect, or non-Radicale image → nothing is written to
  the shared config and no source/credential is registered. 4 new tests cover
  the three refusal paths + the verified-image happy path.
- ICS feed fetch now streams with a hard 5 MiB body cap (same bound as the
  CalDAV path) via readBodyCapped(); oversized feeds reject mid-stream and
  degrade to per-source error. Test covers a >5 MiB feed end-to-end.
- Verifier mode separation: `--verify` runs the same checks fully read-only
  (all output under mktemp -d in /tmp, transcript printed to stdout, scratch
  removed on exit — proven rc=0 with zero repo/tmp-side writes); default
  transcript mode is explicitly declared a TRANSCRIPT GENERATOR in its header
  and writes only under the script's own directory.
- Full-suite count assertions replaced with the documented invariant
  (failed ∈ [5,7], failing set == known-flaky billing suite, extras pass
  isolated rerun) — judge r3 polish.
- Stale credential-key comment in radicale-provisioner.js header corrected.

Calendar suites: 43 passed (38 + 5 new). Perf note: readBodyCapped streams;
no full-buffer read of unbounded bodies on the ICS path anymore.

dashcaddy-api/src/calendar/radicale-provisioner.js

@@ -6,7 +6,8 @@
  *   2. Writes the Radicale config (htpasswd auth) + htpasswd file into the
  *      mounted config volume BEFORE the container starts
  *   3. Stores the credentials in the DashCaddy credential manager under
- *      `calendar:radicale:<subdomain>`
+ *      `calendar:source:<source.id>` (unified key — the same key the events
+ *      fetcher resolves for manual sources)
  *   4. Registers a calendar source so the dashboard calendar widget finds
  *      it automatically on first render — no user input at all
  *