fix(cache): harden cache backends, resilience, recovery, and transports

- RESP -ERR no longer closes healthy conn / aborts batch; global cap replacement-aware
- global health-check pass serialized (latent data race); MemoryMonitor via ResourceManager
- token-exchange retry, open-circuit rejections counted as failures
- TLS-posture matching transport reuse (no silent InsecureSkipVerify handoff)

internal/cache/resilience/circuit_breaker.go

@@ -132,7 +132,14 @@ func (cb *CircuitBreaker) AllowRequest() bool {
 
 		if shouldRetry {
 			cb.setState(StateHalfOpen)
-			return true
+			// Count this probe toward the half-open gate. Previously the
+			// open→half-open transition returned true without incrementing
+			// halfOpenRequests, so N goroutines arriving at the cooldown
+			// simultaneously all transitioned and passed as an unbounded
+			// burst (the half-open branch below is only reached by
+			// requests that race in after the first transition) (R152).
+			current := cb.halfOpenRequests.Add(1)
+			return current <= int32(cb.config.HalfOpenMaxRequests) // nolint:gosec // HalfOpenMaxRequests is operator-bounded well below int32 max
 		}
 		return false