fix: respect no-cache/no-store TTL=0 from parseCacheTTL

parseCacheTTL returns 0 to signal "do not cache" (no-cache, no-store,
or expired Expires header). The ttl <= 0 guard in endorsements.go and
cosign.go was overriding this with the default TTL, causing responses
that should not be cached to be cached. Changed to ttl < 0 so only
truly invalid values get the fallback.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sangwa

internal/cosign.go

@@ -131,7 +131,7 @@ func (s *Server) fetchCosignSignatures(ctx context.Context, urls []*url.URL, cli
 			ttl = t
 		}
 	}
-	if ttl <= 0 {
+	if ttl < 0 {
 		ttl = s.cfg.HTTPCacheDefaultTTL
 	}
 

internal/endorsements.go

@@ -101,7 +101,7 @@ func (s *Server) fetchEndorsementDocumentsWithClient(ctx context.Context, urls [
 			ttl = t
 		}
 	}
-	if ttl <= 0 {
+	if ttl < 0 {
 		ttl = s.cfg.HTTPCacheDefaultTTL
 	}