ci: cache Rust builds with Kache

[M4n5ter]

English

Use Kache to reuse Rust compiler artifacts from the default branch across pull requests without adding external cache infrastructure.

• Install pinned Kache 0.16.0 through the Apache-approved, checksum-verifying taiki-e/install-action.
• Persist only KACHE_CACHE_DIR with GitHub-owned actions/cache/restore and actions/cache/save; keep runtime events job-local in KACHE_RUNTIME_DIR.
• Give each workload/platform/compiler lineage one stable restore prefix and publish immutable generations keyed by the actual checked-out revision. Kache remains the authority for artifact validity through its content-addressed compiler keys.
• Keep pull requests restore-only. Only the repository default branch publishes cache generations.
• Write a current-job Kache report to each job summary.
• Cover the five primary Rust CI boundaries with natural default-branch producers: Runtime Host peer quality, Gitoxide helper admission, Windows sandbox evidence, the direct-peer release matrix (including Linux zigbuild), and conditional CLI packaging in core CI.

Desktop packaging and release workflows remain outside this change: caching their incidental Cargo invocations would add cache-producing lifecycle modes to workflows owned by installer, signing, and release semantics.

The direct kunobi-ninja/kache-action integration is rejected by the Apache organization action allowlist, so this uses existing approved building blocks while preserving restore-only PR trust boundaries.

Validation:

• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 on the affected workflows
• node --test --test-concurrency=1 scripts/ci-test-plan.test.mjs scripts/verify-windows-harness.test.mjs (91 tests passed)
• npm exec -- biome check scripts/ci-test-plan.test.mjs
• git diff --check
• Live GitHub Actions runs verified Kache installation and wrapping on Linux, macOS, Windows, and Linux zigbuild; the updated head is rerunning CI

中文

使用 Kache，让各个 PR 复用默认分支生成的 Rust 编译产物，同时不引入外部缓存基础设施。

• 通过 Apache 已允许且会校验下载内容的 taiki-e/install-action 安装固定版本 Kache 0.16.0。
• 只使用 GitHub 官方 actions/cache/restore 和 actions/cache/save 持久化 KACHE_CACHE_DIR；运行事件保留在 job 独立的 KACHE_RUNTIME_DIR。
• 每组 workload、平台和编译器组合只有一个稳定 restore prefix，并用真实 checkout revision 发布不可变代际；产物有效性继续由 Kache 的内容寻址编译 key 负责。
• PR 始终只读缓存；只有仓库默认分支可以发布新缓存代际。
• 每个 job 的 summary 都写入仅属于当前 job 的 Kache 报告。
• 只覆盖具备自然默认分支 producer 的 5 条主要 Rust CI 边界：Runtime Host peer quality、Gitoxide helper admission、Windows sandbox evidence、direct-peer release matrix（包括 Linux zigbuild），以及核心 CI 中按需执行的 CLI packaging。

Desktop packaging 和 release workflow 不属于本次改动：为了其中间接触发的 Cargo 编译而接入缓存，会给负责安装器、签名和发布语义的 workflow 增加额外的 cache producer 生命周期。

直接使用 kunobi-ninja/kache-action 会被 Apache 组织的 Action allowlist 拒绝，因此改用仓库已有的受准组件，同时保留 PR 只读的信任边界。

验证：

• 对受影响的 workflow 执行 go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
• node --test --test-concurrency=1 scripts/ci-test-plan.test.mjs scripts/verify-windows-harness.test.mjs（91 个测试通过）
• npm exec -- biome check scripts/ci-test-plan.test.mjs
• git diff --check
• GitHub Actions 实跑已验证 Linux、macOS、Windows 和 Linux zigbuild 上的 Kache 安装与编译器包装；更新后的 head 正在重新运行 CI

[jackwener]

Approved at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

---

Review notice: This approval was submitted by an automated review agent operated by jackwener and is published at the direction of M4n5ter, who is the human accountable for it.