ci: unfreeze the build caches and build the bindings centrally

[andiwand]

🤖 Generated with Claude Code

Stacked on #618.

Two changes, independent of each other.

1. Stop freezing the conan and ccache caches

actions/cache never overwrites an existing key, so a key that never varies is written exactly once and then frozen — every later run restores that first snapshot and rebuilds whatever is missing from source.

Measured on run 30175816272, the ubuntu-clang build spends 13 of its 22 minutes in conan install, rebuilding 14 dependencies from source (pdf2htmlex, poppler, cairo, fontforge, wvware, fontconfig, libgsf, …) — on every single run. Every job in that run logs Cache restored from key: …; none logs a cache save. The control case is already in the repo: the jni workflow's key was young enough to hold a complete cache, and it did the same conan install in under a minute.

Two jobs sharing one key made it worse — build and build-test-downstream both wrote conan-ubuntu-24.04-clang-18-r1 with different dependency sets, so whichever landed first left the other rebuilding forever.

• conan is now keyed on what determines its content (odr-index revision + conanfile.py + conan config + profile), so it is rewritten precisely when the dependencies change.
• ccache gets a per-run key restored by prefix so it can actually grow, and is written only on the default branch — branch-scoped entries are invisible to other branches and would only churn the 10 GB repo quota, which is already full (10.74 GB across 24 entries).
• CACHE_FLAVOR separates jobs that resolve a different dependency set for the same profile.

CCACHE_KEY_SUFFIX/CONAN_KEY_SUFFIX stay as the manual "throw it all away" knob.

2. Build the bindings in the central build job

jni.yml and python.yml's build-test each reconfigured and rebuilt the core from scratch for ubuntu-clang and macos-26 — the two profiles build_test already covers. Per push: three independent resolutions of the same dependency graph, three compiles of the same library, three sets of caches competing for quota.

ODR_CLI/ODR_TEST/ODR_JNI/ODR_PYTHON are independent add_subdirectory guards and with_jni/with_python only widen the conan graph, so a single configure produces all of it. The matrix gains a bindings flag; both suites run in-job via ctest since they take seconds and an artifact round-trip would cost more than it saves.

jni.yml is removed and python.yml keeps format/wheels/sdist/publish/pypi.

What deliberately did not move

• wheels builds the reduced dependency set pyproject.toml pins (no pdf2htmlEX/wvWare/libmagic — their runtime data cannot ship inside a wheel), so its binary cannot be the one build_test produces. It is also already cheap at 4–5 min.
• maven is untouched: the jar is classes-only and needs no native artifact. It only becomes a consumer of this job if the jar ever bundles per-platform libodr_jni.
• windows / android stay without bindings.

Trade-off

Binding compile time now sits on the critical path ahead of docker and the reference-output test job, and a binding failure blocks them. Limited to the two profiles that need it.

Verification

actionlint clean apart from pre-existing warnings. ctest --test-dir build/python is a new invocation (the old workflow called pytest directly) — verified locally against a build with ODR_JNI/ODR_PYTHON/ODR_TEST all on: 32 passed. The JNI ctest path is unchanged from jni.yml.