Bound generated .spk filenames so long architecture lists fit

[mreid-tt]

Summary

Follow-up to #329. That fix stopped the sidecar temp name from overflowing the filesystem's per-name limit, but the underlying .spk filename itself is still unbounded: it concatenates every architecture code, and the platform has 51 of them (joined arch list ≈ 457 bytes vs the 255-byte NAME_MAX). This bounds the filename at generation time.

Changes

Bound the generated filename (domain/shared_kernel.build_filename)

Keeps the Synology convention <package>.v<version>.f<firmware>[<archs>].spk when it fits MAX_BUILD_FILENAME = 240 bytes. Beyond that, it keeps the leading archs and collapses the remainder into a short deterministic token (sha1 prefix), e.g.:

vaultwarden.v6.f42661[apollolake-…-purley-r1000-b14ed62c].spk   (247 → 234, sidecar 239)

noarch is the only arch token the filename parser reads (target_noarch), so it is kept first and never truncated. Unique per arch set (package + version + firmware already disambiguate), and the name is hard-bounded.

Preserve the sidecar's permissions (views/tasks.py)

The #329 fix used tempfile.mkstemp, which creates files mode 0600, so sidecars silently changed from -rw-r--r-- to -rw-------. Now uses a short uuid-based temp name written with io.open, restoring the original umask-based permissions. Same atomic os.replace.

Tests

• New unit tests for the filename bound, readable-prefix retention, noarch preservation, uniqueness, and sidecar headroom; a regression test asserting the sidecar keeps umask-based permissions.
• Trimmed redundant tests: folded a noarch case into a parametrized test, dropped a subsumed profile test, removed six test_admin_actions.py overrides that were exact copies of _AdminActionTestMixin tests (the inherited tests still run for both views), and removed a trivial task-binding assertion.

Impact

• Package page / catalog still show the full arch set (from the ORM, not the filename); the filename is only the download slug.
• Download-stat attribution is unchanged: builds match by exact path, device arch comes from the log record, and target_noarch/target_firmware_build still parse from the name.
• Existing builds are never regenerated — only new uploads use the bounded scheme.

Verification

• pytest — 380 passed, 45 subtests.
• sphinx-build -W -b html clean; pre-commit clean.