Enhance scratchbox storage metadata management

- Updated `README.md` to clarify the distinction between public scratch IDs and internal blob IDs.
- Modified `filesystem.go` to introduce a new `BlobID` field in the `Metadata` struct, ensuring the separation of public and internal identifiers.
- Implemented functions to generate and reserve unique public IDs for scratch entries, improving metadata integrity.
- Adjusted tests in `filesystem_test.go` to validate the new ID structure and ensure public IDs do not match blob hashes.

internal/storage/filesystem_test.go

@@ -123,9 +123,12 @@ func TestCreateEncryptedStoreDoesNotExposeGzipHeaderOnDisk(t *testing.T) {
 		t.Fatalf("ReadFile(encrypted) error = %v", err)
 	}
 	sum := sha256.Sum256(filePayload)
-	wantID := hex.EncodeToString(sum[:])
-	if meta.ID != wantID {
-		t.Fatalf("meta.ID = %q, want SHA-256 of encrypted blob %q", meta.ID, wantID)
+	wantBlobID := hex.EncodeToString(sum[:])
+	if meta.BlobID != wantBlobID {
+		t.Fatalf("meta.BlobID = %q, want SHA-256 of encrypted blob %q", meta.BlobID, wantBlobID)
+	}
+	if meta.ID == wantBlobID {
+		t.Fatalf("meta.ID should be a short public id, got blob hash id %q", meta.ID)
 	}
 }