feat(cache): add trust-scoped package cache

[rldyourmnd]

Outcome

Adds a public composite action that restores/saves package-manager caches over the existing one-job, repository/trust-scoped RustFS identity on private Drakkars runners.

Supported ecosystems: Go, npm, pnpm, Yarn, Bun, uv, pip, Cargo, Maven and Gradle. Package downloads are cached independently from build/compiler outputs.

Security boundary

• disabled when no NDDev assignment exists, so public hosted jobs keep native behavior
• exact manager/runtime/lock/OS/arch cache identity
• cache paths must remain below runner HOME
• archive extraction uses private staging and rejects paths outside declared roots and special files
• release-reader is read-only; trusted/untrusted writers stay in their own repository trust prefix
• authentication denial fails; transient cache outages degrade to uncached execution
• no new credential, service, dependency, permission, or public/private inventory

Observability

Every operation emits a structured nddev_package_cache_event with hit/miss/result, non-secret key digest, bytes and duration.

Runtime evidence policy

No synthetic fleet job is created. The action will be adopted through a real estate workflow after this public hosted gate merges; only that real project job can establish RustFS latency and benefit.