fix(sandbox): read the golden's own mtime for TTL pruning, not its lockDir's

[pedrofrxncx]

Follows #5824/#5843 (the L1/L2 golden-tier rework merged today) — a bug in the L1 pruning code, not a follow-up feature.

Bug: pruneGoldens (packages/sandbox/daemon-go/internal/setup/golden.go) computes each entry's mtime from the lockDir itself (golden/<repo>/<pm>-<lockHash>), but TryRestoreGolden marks a golden as recently-used by calling os.Chtimes on .../node_modules — the child directory, not the lockDir. Updating a child's mtime via utimes never touches its parent directory's own mtime, so the lockDir's mtime is set once at publish time (via the rename in PublishGolden) and never again. The code comment even claims the opposite ("Restore touches a golden's mtime, so an actively-used lockfile never ages out" — golden.go:22), but it touches the wrong path for that claim to hold.

Failure scenario: any lockfile whose golden was published more than GoldenTTL (7 days) ago keeps getting restored-from every day, but the periodic prune sweep still reaps it once past the TTL, because the mtime it reads never moved. Every subsequent boot for that lockfile silently falls back to a full install — the exact perf regression the golden cache exists to prevent — with no error or signal, since restore itself doesn't check TTL, only the sweep does.

Fix: pruneGoldens now stats <lockDir>/node_modules (the same path TryRestoreGolden touches) instead of the lockDir. Updated TestPruneGoldens's mkGolden helper to build the real nested layout, and added a regression case (a restore touching only node_modules' mtime still protects the golden) that fails against the old code (verified locally by reverting golden.go and re-running: 3 of 6 subtests failed, including the new one) and passes with the fix.

Verify: cd packages/sandbox/daemon-go && go test ./internal/setup/... -run TestPruneGoldens -v

Checked locally: go test ./internal/setup/... (full package, green), gofmt -l (clean), go vet ./internal/setup/... (clean). Full CI runs the rest.

---

Summary by cubic

Fixes golden cache pruning to read <lockDir>/node_modules mtime so active goldens aren’t reaped by TTL. Prevents silent full installs when a golden is still in use.

• Bug Fixes
  • Updated pruneGoldens to stat <lockDir>/node_modules (matches TryRestoreGolden) instead of the lock directory.
  • Adjusted tests to use the real nested layout and added a regression case to ensure restore-only mtime updates prevent pruning.

^{Written for commit 96144dc. Summary will update on new commits.}