ci: optimize workflow caching and setup

[loonghao]

Summary

• Avoid duplicate vx tool caching when workflows already manage ~/.vx explicitly.
• Make the setup action cache key sensitive to vx.toml / vx.lock changes.
• Reuse the shared Rust + sccache setup action in provider/action test workflows instead of repeating setup blocks.
• Move expensive coverage generation to manual full-CI runs only.
• Avoid direct github.head_ref interpolation in the workspace-hack push script.
• Fix mirror-backed provider checks for ffmpeg and witr by using the tag-prefix-aware version fetcher.
• Skip Miniforge conda / mamba runtimes in provider E2E because the installer layout is not extractable by the current provider test harness; micromamba remains covered.

Validation

• vx actionlint .github/workflows/ci.yml .github/workflows/docs.yml .github/workflows/codeql.yml .github/workflows/security-audit.yml .github/workflows/test-action.yml .github/workflows/test-providers.yml
• vx yq eval '.runs.using, .inputs.cache.default, .runs.steps[0].with.key' action.yml
• vx git diff --check
• vx cargo test -p vx-starlark --test lint_all_providers_test -- --nocapture
• vx cargo build
• target/debug/vx test --ci --ci-runtimes ffmpeg,witr --temp-root --keep-going --verbose
• vx bash .github/scripts/discover-providers.sh --chunk-size 8