fix: prepare downloader 1.6.0

[Priveetee]

Summary

• mark Garage artifact redirects as internal
• allow Server to proxy downloads without requiring a public Garage endpoint
• make the storage reservation test deterministic when free disk space changes during the check
• prepare Downloader version and image metadata for TypeType 1.6.0

Production behavior

Download artifacts stored in Garage can be delivered through the authenticated Server gateway while Garage remains private to the Compose network.

Deployment requirements

No configuration or storage migration is required.

Tests

• go test ./internal/storage -run TestMonitorTracksAndReleasesReservations -count=1000
• gofmt verification
• go test ./...
• go build ./...
• script syntax validation
• docker compose config --quiet
• git diff --check

Rollback

Restore Downloader revision 68624aad.