Fix IntegrityError when first-time pull-through fails digest validation

[gerrod3]

On a first-time pull-through download, _match_and_stream builds the ContentArtifact and RemoteArtifact unsaved. If the download then fails digest validation, _stream_remote_artifact tries to save failed_at on the RA, which violates the core_remoteartifact foreign key to the never-saved CA.

Effects before this change:

• The content app logs an FK IntegrityError instead of the intended "failed checksum validation" error.
• close_tcp_connection is skipped, so the client gets a clean 200 OK with the full unvalidated body (checked with curl, exit 0).

Now failed_at is only recorded when the RA's ContentArtifact already exists. The connection is always closed and the RuntimeError always raised, so the client sees a broken transfer (curl: (18) transfer closed with outstanding read data remaining).

This does not add a failure cooldown for first-time pull-through; that is left for a follow-up.

Tests: two unit tests in pulpcore/tests/unit/content/test_handler.py. The new-ContentArtifact test fails without the fix with the FK IntegrityError. A functional test isn't possible since pull-through RAs carry no digests and pulp_file doesn't implement pull-through.

📜 Checklist

• Commits are cleanly separated with meaningful messages (simple features and bug fixes should be squashed to one commit)
• A changelog entry or entries has been added for any significant changes
• Follows the Pulp policy on AI Usage
• (For new features) - User documentation and test coverage has been added

🤖 Generated with Claude Code