perf(zccache) Phase 3: embedded fingerprint API replaces 'zccache fp' shellouts #792

Sub-issue of #789. Depends on Phase 2.

Scope

Migrate check_fingerprint / mark_fingerprint_success in
crates/fbuild-build/src/zccache.rs off the zccache fp CLI to an
embedded library equivalent. Today both shell out to the wrapper binary
via fbuild_core::subprocess::run_command — even when
FBUILD_ZCCACHE_EMBEDDED=1 is active, fingerprint checks still spawn a
zccache child, which defeats the purpose of embedded mode.

Deliverables

• An in-process equivalent of zccache fp check --root … --ext … --exclude …
  exposed by the zccache library, consumed from
  crates/fbuild-build/src/zccache.rs when CompileBackend::Embedded is
  active. Return type maps cleanly onto the existing FingerprintCheck
  enum (Changed / Unchanged).
• Equivalent for zccache fp mark-success.
• If the library does not currently expose these as a public API, file an
  upstream issue against zackees/zccache and link it here. Block this
  phase on that landing.
• Wrapper-mode fingerprint path remains so default builds are unaffected.

Acceptance

• With FBUILD_ZCCACHE_EMBEDDED=1, no zccache.exe / zccache-fp
  child process is spawned for a full uv run test cycle.
• Embedded check_fingerprint returns the same Changed/Unchanged
  verdict as the wrapper on the same workspace state for at least
  three scripted scenarios (clean, modified-source, modified-exclude).
• Wrapped-mode tests in zccache.rs unchanged and still green.
• No regression in tests/platform/* build correctness.