feat(checkpoint): store OPF span results in the git common dir

Implements redact.OPFSpanCache as one small JSON file per blob under entire-opf-cache/, written atomically through the shared git-common-dir root. Keys must be SHA-256 digests. Entries older than 30 days can be pruned.