Add reclaim-disk-space, report-disk-space, and configure-azure-sccache actions

[tycho]

These are the reusable building blocks from the linux-kernel-oci disk-pressure and sccache work, extracted so xen-oci and other future builders consume the same logic instead of copies.

reclaim-disk-space deletes preinstalled runner tooling by category. The categories that can break other workflows are opt-in rather than default: remove-toolcache wipes /opt/hostedtoolcache (which setup-* actions and installers like cosign-installer depend on - the action documents that it must run before them), and remove-rust would break runner-side Rust builds and setup-cargo-make's ~/.cargo/bin cache. Reports the KB freed as an output and prints the resulting disk state.

report-disk-space prints all real filesystems with type and mount point, pseudo-mounts filtered. Runner disk topology varies by class and generation and public documentation is unreliable, so every job log should carry the ground truth, especially for ENOSPC post-mortems.

configure-azure-sccache selects between read-write and read-only Azure connection strings from an explicit allowlist of maintainer-gated trigger events, failing closed for everything else so unreviewed code can never write to the shared cache. Non-secret settings (mode, container, key prefix) are exported via GITHUB_ENV, but the connection string is deliberately only a step output: GITHUB_ENV exports land in the process environment of every subsequent step, including third-party actions, whereas an output reaches only the steps that explicitly bind it as env at the point of use. That step-env binding is the single consumption contract for every caller; only the final hop differs, dictated by which side of docker's build/run divide the compile lives on: a runtime compile (docker run, linux-kernel-oci) passes the variable through by name with -e, while a build-time compile (RUN inside buildx, xen-oci) must use a BuildKit secret mount fed via secret-envs, since runner env does not reach RUN steps and build-args would persist the value into image history. Log masking is value-based and unaffected by the transport.