#3345 fix(crafter): release go-git packfile descriptors after repository reads

Closes PFM-6929

Summary

Since the go-git v6 alpha.5 bump (#3336), every PlainOpen* call builds its own 256-entry descriptor pool holding roughly 3 descriptors per packfile, freed only on LRU eviction — which never fires below 256 entries. alpha.4 released them right after each read.

The crafter opens the repository up to twice per attestation init and never closed the storer, so those descriptors stayed open until the process exited. They are now released through storer.IdleReleaser once the reads complete; descriptors reopen lazily, so the repository remains usable.