cargo-rail-action v10.1.0

cargo-rail-action v10.1.0 pairs with Cargo-Rail 0.30.0,
the only version it supports and the one every public action installs by default.
The v10 alias now points to this release (4d7bebe671430eee0db376de3f943d8de26e78de).

Highlights

• Workflow audit. Before planning, the planner audits every workflow for Cargo-Rail Action references
  and stops on an earlier major version, an input or output this release does not provide,
  or a needs consumer of an output the planning job does not export.
  cargo-rail-action audit runs the same check locally.
• Planning evidence transfer. The evidence input accepts a directory of evidence files,
  one per recorded work item, so Cargo-Rail 0.30.0 can skip work for changes no compiled unit reads.
• Safer plans. Selectors reject a plan created on another platform before checkout verification,
  and target-args narrows Cargo work only when every selected target is an integration test.
• Shallow history. Pull-request history fetches authenticate with exactly one repository credential,
  and a failed fetch reports a safe cause and one recovery action.

Upgrade notes

• No input or output was removed. Workflows pinned to @v10 move to this release;
  pin 4d7bebe671430eee0db376de3f943d8de26e78de for an exact reference.
• Compiler caches start cold once, because Cargo-Rail 0.30.0 changed its action keys.
• Give remote cache credentials only to trusted jobs: read access exposes every cached result to the job that holds it.
• Run cargo-rail-action audit from this release to check every workflow reference before you upgrade.

Every runtime, the runtime manifest, and LICENSE carry build-provenance attestations:

gh attestation verify cargo-rail-action-x86_64-unknown-linux-gnu -R loadingalias/cargo-rail-action

All changes

• The cache action accepts the optional recent_evictions record that Cargo-Rail's cache status reports
  when collection evicts results within a day of their last use,
  and still rejects any malformed record.

• Every public action now installs Cargo-Rail 0.30.0 by default,
  the only version this release supports.
  Plans are still contract v9 and cache status is still schema 18; planning evidence is planning-evidence-v2,
  which 0.30.0 records.
  Compiler caches start cold once after the upgrade,
  because Cargo-Rail 0.30.0 changed its action keys.
  CI tool installation on Linux and Windows now authenticates cargo-binstall's GitHub API lookups,
  as macOS already did.

• The cache action now accepts only Cargo-Rail cache status schema 18.
  It rejects the retired schema 16, which no Cargo-Rail release has emitted since v0.28.0.
  The README states that each Action release supports exactly the Cargo-Rail version in its lock.

• Selectors and the planner now reject a plan created on another platform
  before checkout verification.
  The error names both platforms and tells the operator to create a plan on this platform.
  The README adds a grouped-job example that guards each selector with its own work ID,
  and a macOS job that routes on a Linux plan but plans again before reading selectors.
  The planner summary now lists the platform, source, Cargo, toolchain,
  and target bindings that every selector verifies.
  The summary also states whether portable evidence was supplied,
  and each widened item names the changed files that lack negative evidence.

• Authenticate shallow pull-request history fetches with exactly one repository credential,
  including checkouts that persisted their own credentials.
  Report a failed history fetch with a safe cause and one recovery action instead of an exit code.
  target-args now narrows Cargo work only when every selected target is an integration test.

• The planner's evidence input accepts a directory and passes each *.json file in it to Cargo-Rail,
  so a workflow can restore one evidence file per recorded work item and tolerate a cache miss.
  The plan reader accepts planning-evidence-v2 identities, which the matching Cargo-Rail release records,
  and the summary reports how many evidence manifests the plan used.
  The README shows how to record evidence in default-branch jobs, save it by commit,
  and restore the base commit's evidence before planning.

• The README no longer recommends mode: read for pull requests and other untrusted jobs.
  A job that runs untrusted code gets no remote cache credentials and does not run the cache action,
  because read access exposes every cached result to that job.
  read is for trusted jobs that must not publish, and read-write for trusted jobs that seed the cache.
  The README also shows how to verify a release asset's attestation with gh attestation verify.

• The planner now audits every tracked or unignored YAML file for Cargo-Rail Action references
  before planning, and cargo-rail-action audit runs the same audit locally.
  An earlier major version, an input or output the current release does not provide,
  a needs consumer of an output the planning job does not export, or an unparseable file stops the planner.
  Exporting plan-file as a job output and reading a plan on another runner label produce warnings.