l2md: integrate manifest fingerprint checks into sync loop

Wire up the manifest-based change detection into the existing sync
infrastructure:

- env.c: In sync_env(), check manifest_url_changed() before each
  repo_pull() and skip URLs whose fingerprint hasn't changed. Only
  persist the new fingerprint after a successful repo_pull() (deferred
  update pattern) to avoid marking a URL as current when the fetch
  actually failed. Call manifest_sync_done() after each sync cycle to
  free cached manifest JSON while preserving failure cooldown state.

- config.c: Call manifest_cleanup() on shutdown in config_uninit().

Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>