ci(cache): setup-soldr v0.9.78 save-cache: auto, share the Linux dev cook base, cache-policy guard (#355)

[zackees]

Fixes #355
Part of zackees/setup-soldr#528

Changes

• Pin bump: all seven zackees/setup-soldr steps (ci.yml x3, release.yml x2, auto-release.yml, macos-x64-tests.yml) move from c2a3b96 (v0.9.77) to fabebf4 (v0.9.78, setup-soldr#527). Each step now sets save-cache: auto explicitly, so pull-request runs still restore but upload no durable cache layers.
• No save-cache: "true" anywhere: in a PR run, no job restores an entry that another job in that run saved. linux, each build target and dylints key their own caches, and test compiles nothing.
• Cook-base sharing (audit):
  • The only same-target, same-graph pair was ci.yml linux and release.yml validate-and-package, both x86_64 Linux. The release job cooked --release with no suffix, although every step it runs (cargo test, crate package verification) compiles the dev profile. That was a second ~2.4 GB base that nothing reused.
  • It now cooks the dev profile with suffix linux and CARGO_PROFILE_DEV_DEBUG: line-tables-only, so it restores linux's base saved on main.
  • These graphs genuinely differ and stay separate: the five build targets (one base each, keyed by matrix.target), dylints (prebuild-deps: none), and the cache: false release, auto-release and macOS x64 steps.
• Guard: ci/test_cache_policy.py, added to ci.yml's guard-step unittest invocation. It checks:
  • every setup-soldr step uses one pinned 40-char SHA;
  • every step is classified by target and profile;
  • cook flags match the profile;
  • each target and graph uses one suffix, unless JUSTIFIED_SPLITS names a reason;
  • every step states save-cache;
  • no step on a pull_request workflow saves without a v0.9.78+ pin and save-cache auto or false, unless PR_SAVE_JUSTIFICATIONS names a reason (empty today);
  • stale justifications fail.

RED -> GREEN

Against the old workflows (v0.9.77 pins), with the new test in place: FAILED (failures=12).

• test_no_step_saves_on_pull_request fails for ci.yml linux, build and dylints: they need a v0.9.78+ pin with save-cache unset or auto.
• test_every_step_states_its_save_policy fails for all 7 steps.
• test_cook_flags_match_the_compiled_profile fails for release validate-and-package: '--release' != ''.
• test_one_suffix_per_target_and_graph fails: {'linux': ['ci.yml:linux'], '': ['release.yml:validate-and-package']}.

After this change: Ran 8 tests ... OK.

Local validation

• soldr cargo fmt --all -- --check: OK.
• CI unittests (ci.test_native_proof ci.test_native_proof_jobs ci.test_macos_x64_guest ci.test_ci_modes ci.test_release_ci_gate ci.test_nextest_config ci.test_deny_warnings ci.test_target_features ci.test_cache_policy): 92 tests, OK.
• soldr cargo clippy --locked --all-features --all-targets -- --deny warnings: OK with OPENSSL_NO_VENDOR=1. Local-only issue: on this host, vendored OpenSSL fails at providers/liblegacy.a under the zccache C wrapper. No Rust changed here.
• soldr cargo build --locked --all-features: OK, with the same local workaround.
• Platform-boundary scan (--lib -- --skip ui): 21 passed.
  • It ran with the pinned nightly's cargo called directly. Under soldr rustup run, this host's orphaned soldr daemon refused the broker route ("soldr root ownership is busy").
• soldr cargo check --locked --lib with the ci/target_features.py feature set: OK for x86_64-pc-windows-msvc and for aarch64-apple-darwin.

🤖 Generated with Claude Code