ci: speed up pipelines with shared rust-cache

[davidbudnick]

Summary

Cut CI wall time and machine-minutes by fixing rust-cache thrash (~21 GB / 22 entries, intermittent Windows/MSRV misses), cancelling superseded CI runs, dropping a redundant Linux compile job, and enabling Windows release caching for labeled PR packaging.

Measured baseline (live runs + local sim): quiet thrashy PRs ~8–10 min wall (Windows clippy cold ~5–6 min); push storms worse due to no CI concurrency cancel. Expected after warm master caches: ~4–6 min wall on thrashy days, ~30–50% fewer machine-minutes; quiet already-warm PRs gain little wall time.

Changes

ci.yml

• Concurrency with cancel-in-progress: true (CI never signs/publishes).
• prefix-key: v1-rust to age out thrashing v0-rust multi-GB entries.
• shared-key groups: linux-stable-debug (clippy / test-linux / docs-hid), msrv-debug, macos-stable-debug, windows-stable-debug.
• save-if master/main only — PRs restore base-branch caches without writing new keys under the 10 GB soft limit.
• Drop check-linux — stable cargo clippy --workspace --all-targets already subsumes cargo check (same rationale as clippy-windows). MSRV remains via the 1.96 matrix.
• docs-hid: move RUSTDOCFLAGS to step env so it can share the Linux debug cache key.
• cargo-deny: switch to taiki-e/install-action + cargo deny check (faster than full action bootstrap).

build.yml

• Shared release cache keys for macOS / Linux packaging (macos-stable-release, linux-stable-release).
• Add Windows rust-cache (windows-stable-release-${{ matrix.arch }}) — the old “tag-only, no cache” comment was outdated; this workflow also runs on needs: build PRs and dispatch.
• Cache Homebrew downloads; single brew install librsvg create-dmg.
• Preserve existing should-build / needs: build label gate.

release-plz.yml / release.yml

• Restore CI linux-stable-debug deps with save-if: false (CI master is the canonical writer).

Explicit non-goals

• No sccache in CI (local sim: miss path slower; without a remote backend GHA runners are ephemeral).
• No apt package image rewrite (secondary ~15–30s vs multi-minute compiles).
• No product / IPC / protocol changes.

Testing

• python3 -c "import yaml; …" — all four workflows parse.
• Local multi-agent simulation: clippy subsumes check; sccache not worth CI without remote store.
• Live cache inventory prior to change: ~21 GB / 22 entries under v0-rust.
• Not runtime-tested on GitHub Actions yet — first CI run after merge will populate v1-rust keys on master; PR runs restore once master has saved.

Expected impact

Scenario	Before (approx)	After (approx)
Quiet PR, Windows cache miss	8–10 min wall	4–6 min wall
Rapid force-pushes	10–15+ min + N full matrices	1 live matrix, rest cancelled
Machine-min / green PR	high (thrash + cancel waste)	~30–50% lower steady-state
Cache keys	~22 fragmented multi-GB	~8–12 shared groups

[greptile-apps]

Greptile Summary

The PR streamlines CI and packaging workflows:

• Shares Rust caches across compatible jobs and restricts canonical CI cache writes to default-branch runs.
• Adds cancellation for superseded CI runs and removes the redundant Linux check job.
• Adds release-build caching for macOS, Linux, and Windows packaging.
• Aligns release workflow cache environments with CI and preserves all-feature dependency-policy checks.
• Consolidates Homebrew installation and caches downloaded packages.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Adds shared cache policy and concurrency cancellation, removes redundant checking, and retains all-feature cargo-deny coverage.
.github/workflows/build.yml	Adds platform-specific release caches and Homebrew download caching without changing packaging gates.
.github/workflows/release-plz.yml	Aligns the Rust environment with CI so both release-plz jobs can restore the canonical Linux debug cache.
.github/workflows/release.yml	Aligns the publish job’s Rust environment and restores the CI-owned Linux debug cache for the manifest generator.

_{Reviews (3): Last reviewed commit: "ci: put cargo-deny --all-features before..." | Re-trigger Greptile}