[Leechael]

Problem

Admin.ClearImageCache with a specific config_hash returns success but deletes nothing.

The verifier stores measurement cache entries as measurements/<key>.json (CvmVerifier::measurement_cache_path), but KmsState::clear_image_cache removes measurements/<config_hash>, without the suffix. remove_cache finds neither a dir nor a file at that path and returns Ok(()). Passing <key>.json as the key does not work either, because the key must be pure hex.

So only config_hash = "all" actually clears measurements. Clearing one image with {"image_hash": "<hash>", "config_hash": "<key>"} leaves its cached MRs behind, and the next legacy TDX verification re-downloads the image but reuses the stale measurements. The mismatch has existed since the measurement cache moved to <key>.json files (already the case in v0.5.6).

Fix

• The verifier exports MEASUREMENT_CACHE_SUFFIX (".json") and uses it in measurement_cache_path, so the naming lives in one place.
• remove_cache takes a suffix. The KMS passes "" for images/<hash>/ and MEASUREMENT_CACHE_SUFFIX for measurements/.
• The hex-key guard and the "all" behavior are unchanged.

Verification

Run in rust:1.92-bookworm (sev-snp-attest does not build on macOS):

• New test remove_cache_deletes_the_measurement_cache_file: fails with the old path logic (parent_dir.join(sub_dir), panics at the "named measurement entry must be removed" assertion) and passes with the fix.
• cargo test -p dstack-kms: 59 passed. cargo test -p dstack-verifier --lib: 39 passed.
• cargo clippy -p dstack-kms -p dstack-verifier -- -D warnings --allow unused_variables: clean. cargo fmt --all --check: clean.

Not covered: a live ClearImageCache call against a running KMS.