Configure zstd passthrough through the compression store

[walter-zeromatter]

Summary

• Add zstd as compression_algorithm.zstd on the existing compression store configuration instead of introducing a new public store type.
• Keep blobs as standard zstd streams at rest and serve eligible --remote_cache_compression clients the stored stream byte-for-byte.
• Expose zstd wire operations through an immediate store capability, so ByteStream and CAS services do not import or downcast to the concrete implementation.
• Preserve bounded staging, upload timeouts, digest validation, recompression limits, and identity-client fallback behavior.
• Update configuration examples and operator documentation for the unified compression-store shape.

Why

Compression is already modeled as a store with an algorithm choice, so zstd belongs on that existing configuration surface alongside LZ4. The zstd implementation remains specialized internally because it can reuse the stored frame on the REAPI wire; that behavior is exposed as a store capability rather than as a service dependency on a new concrete store type.

The capability is intentionally immediate. Configure the compression store as the instance CAS boundary to enable byte-for-byte passthrough. An outer wrapper remains correct but uses the normal decode/re-encode fallback at that boundary.

Configuration

{
  compression: {
    compression_algorithm: {
      zstd: {
        temp_path: "/tmp/nativelink-zstd",
        max_compressed_upload_size: "512MiB",
      },
    },
    backend: {
      memory: {},
    },
  },
}

Use a new or empty dedicated backend namespace for this representation. Rollout and rollback require clearing that cache namespace; there is no in-place migration from identity or LZ4 storage.

Validation

• bazel test //nativelink-config:unit_test //nativelink-config:integration_tests/json5_test_test //nativelink-util:integration_tests/store_trait_test_test //nativelink-store:integration_tests/zstd_store_test_test //nativelink-service:integration_tests/bytestream_server_test_test //nativelink-service:integration_tests/cas_server_test_test
• cargo +nightly fmt --all -- --check
• git diff --check

The focused Bazel suite passes all six targets, including their Clippy aspects. Vale was not available in the local environment, so documentation lint was not run locally.