## Why

`push.yml` saves many setup-go caches per run, but PR / merge_group /
schedule saves are scoped to refs no other run can read. They still
count against the 10 GB per-repo quota and evict main's caches via LRU,
so most PRs miss the cache entirely.

See the [GitHub Actions dependency-caching
docs](https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching)
for the scope and eviction rules.

## What

### `setup-build-environment` composite

The composite now manages the Go cache explicitly instead of relying on
`setup-go`'s built-in caching. `setup-go` runs with `cache: false`. On
`refs/heads/main` (push + the scheduled wipe-and-repopulate cron from
#2092) the unified `actions/cache@v5.0.5` restores immediately and its
post-step saves at the calling job's end — composite-action post-steps
fire at the job's end, not the composite's, so this works inside the
composite. On every other ref, `actions/cache/restore@v5.0.5` restores
only. `restore-keys` provides prefix fallback so PR runs with a changed
`go.sum` still restore main's most recent cache and rebuild only the
delta. The `cache.txt` workaround is gone — `inputs.cache-key` goes
directly into the cache key string.

### Drop `task cover` from CI

`task cover` was a smoke check on main pushes. Cover-instrumented test
binaries land in a different `GOCACHE` slot than the non-cover binaries
PRs need, so a `go.sum` bump landing on a main push would leave the
cache holding cover artifacts until the next 00:00 UTC
wipe-and-repopulate fixed it (up to 24h of PRs missing the test-binary
slot). Running `task test` on every event eliminates that hole; coverage
stays in `Taskfile.yml` for local use and can come back to CI when
there's a real consumer.

### Scheduled cache wipe: twice daily → once daily

The cron from #2092 wiped the cache at 00:00 and 12:00 UTC. The noon
wipe was harmless when every PR repopulated; now that only main runs
repopulate, it creates an unnecessary cold-cache window during the
workday. Trimmed to 00:00 UTC.

## Potential follow-ups

- `check.yml` lint cache
- Three standalone `setup-go` invocations in `push.yml` (`testmask`,
`validate-generated-is-up-to-date`, `validate-python-codegen`)
- `~/.cache/golangci-lint` analyzer cache

This pull request and its description were written by Isaac.