Improve Rust cache reuse with revision-isolated targets (breaking build contract)

[aram356]

Summary

Improve dependency-source and compiler-cache reuse across application commits
while keeping writable Cargo target archives strictly revision-isolated.

Breaking build/cache contract: callers must supply the application's full
SHA when enabling target restores, explicitly opt into target saves, and stop
assuming builds write to <application>/target. Production/staging deployment
semantics, credential boundaries, CLI packaging and release verification are
unchanged.

Closes #416.

Review feedback addressed

• Target saves are opt-in through save-target (default false). Readers use
  actions/cache/restore; writers use actions/cache's success-only post-job
  save, after compilation. Neither restores targets from another revision.
• Full store-aware/store-free fixture target writes are restricted to main.
  Fixed Git dates make unchanged fixture revisions stable across reruns; a
  tracked upstream SHA accounts for EdgeZero path-dependency changes.
• The cross-job seed now compiles both native and WASM libraries. A run-specific
  library identity excludes accidental older compiler hits. The next revision
  changes only README and requires error-free hits on its first builds with a
  fresh target directory, not a same-job build/clean/rebuild.
• Both downstream jobs reconstruct the seed's exported fixture identity, so
  retrying only failed jobs does not change their expected source SHA. All
  three jobs install/select the same .tool-versions Rust compiler.
• Identical setup repeats skip all remote restores and compiler-cache setup.
  Cache-disabled Git workspaces can use local HEAD for ownership; unidentified
  non-Git repeats still fail. Mixed source/workspace/lock/cache settings, unsafe
  paths and unowned targets remain rejected.
• Output contracts recognize cache action identity independently of version/SHA
  pinning; the separate pin gate still applies. Prepare uses append_output.
• Shared test assertions, executable probe scripts, permission-safe cleanup,
  control-character rejection and unused-output removal address the cleanup nits.
• The adoption guide includes complete checkout/SHA/cache/diagnostic steps,
  explicit migration, GitHub branch scope and named sccache limitations. CLI
  comments distinguish a shared job-local target from remote target caching.

The former lockfile-only target policy is intentionally replaced, as required
by #416. Cargo fingerprinting is not a reason to relax this isolation contract.
This does not guarantee a warm complete application build: linker-invoking
crate types, build-script execution and linking still cost work on cold targets.

Migration

Use a stable app-name and capture the checked-out application's full Git SHA,
not the deployment repository SHA. Configure:

with:
  app-name: example-app
  cache-target: true
  save-target: ${{ github.ref == 'refs/heads/main' }}
  target-cache-revision: ${{ steps.source.outputs.sha }}
  working-directory: application

save-target: true requires target caching enabled. Its default is restore-only.
Main-only saves select the workflow ref, not the application branch being built.
Use CARGO_TARGET_DIR or the cargo-target-dir output for build paths, including
when remote target caching is disabled. Prefer one setup per app per job; an
identical repeat is safe but performs no cache restore. First use of v2 target
keys, and each new source revision, has a cold target cache.

Verification

• Cargo workspace/all-targets: 1,520 passed, 0 failed, 1 ignored.
• Cargo fmt, strict all-feature Clippy, feature-combination checks and Spin WASM.
• Cache behavior, retry fixture, CI wiring and output-contract regressions.
• Deployment contracts: 643 passed, 0 failed; five existing Linux-only
  checks skipped locally on macOS and covered by PR CI.
• Local sccache v0.16.0 probe: restarted server, new Git revision and fresh
  target directory; first native and WASM builds each hit with zero cache errors.
• Full ShellCheck, actionlint, third-party pin gate, offline Zizmor scan,
  docs format/lint/build and git diff --check.
• Independent plan and code review; no outstanding correctness findings.
• GitHub-hosted exact-target restore and cross-revision native/WASM
  first-build compiler-reuse probes on commit ff18102.
• Application fixture CI
  observed 204 Rust hits and 17 misses (92.3%), zero cache read/write errors,
  and no full target archive save on this PR run. This is a warmed CI fixture,
  not a production deployment benchmark or a promised hit ratio.
• Final deployment-action CI, including Linux contracts and static checks.
• Remaining final GitHub-hosted CI checks.

No cache deletion, live deployment, merge, release, Trusted Server source change
or Rust dependency upgrade is included. Deployer adoption is in
trusted-server-deployer #36.

[ChristianPavilonis]

Approved. The revision-isolated target cache contract, opt-in saves, and migration requirements are clearly documented.