refactor(core.utils): extract per-code-type strategies for cache-key derivation

The old ``make_program_cache_key`` was a god function with five
``if backend == "..."`` ladders smeared through the body: a
side-effect guard for NVRTC, a use_libdevice guard for NVVM, an
external-content + dir-component guard for NVRTC, a driver-linker
guard for the linker, then a code-encoding branch, an option-
fingerprint branch, a name-expression-tagging branch, three
version-probe branches, and finally a name-hashing + extras
branch. Adding a new backend or guard meant touching all of them.

Replace with a ``_KeyBackend`` ABC and three concrete subclasses
(``_NvrtcBackend``, ``_LinkerBackend``, ``_NvvmBackend``), each
owning every backend-specific decision in one place:

* ``validate(options, target_type, extra_digest)`` -- raise
  ValueError for inputs the backend can't safely key.
* ``encode_code(code, code_type)`` -- coerce the source bytes
  (default rejects bytes; NVVM overrides to accept).
* ``option_fingerprint(options, target_type)`` -- compile-flag
  fingerprint (NVRTC/NVVM use ``options.as_bytes(...)``; Linker
  uses the existing backend-aware fingerprint helper).
* ``encode_name_expressions(name_expressions)`` -- sorted,
  type-tagged tuple, or ``None`` for backends that ignore
  name_expressions (default).
* ``hash_version_probe(update)`` -- mix runtime/compiler version
  via ``update(label, payload)``; on failure mix
  ``_hash_probe_failure(update, label, exc)``.
* ``hash_extra_payload(options, update)`` -- backend-specific
  extras (NVVM ``extra_sources`` + ``use_libdevice``; default no-op
  for NVRTC and Linker).

The orchestrator shrinks to a focused ~50 executable lines:
validate code_type/target_type, dispatch to
``_BACKENDS_BY_CODE_TYPE[code_type]``, hash everything in fixed
order. Universal pieces (``options.name`` propagation,
``extra_digest`` mixing, schema version) stay in the orchestrator
since they apply to all backends.

The schema mixed into the digest is unchanged, so any given input
produces the same key as before. The ``encode_name_expressions``
return type (``tuple[bytes, ...] | None``) is what preserves the
old asymmetry: NVRTC still emits ``names_count=0`` for an empty
input while NVVM/Linker emit nothing, matching the previous
schema bytes byte-for-byte.

Smoke-tested locally: determinism, code_type discrimination,
dir-component rejection (with and without extra_digest), side-
effect-option rejection, extra_sources non-NVVM rejection, NVVM
bytes-code acceptance, non-NVVM bytes-code rejection. The existing
test suite stays as-is (no test exercised the removed branch
structure directly).

Author: cpcloud