ci: one setup-soldr wrapper with plan-driven cache saves (zackees/ci.yml#92)

[zackees]

Closes zackees/ci.yml#92 (part of zackees/ci.yml#37 / #52, round M2-41).

Changes

• .github/actions/soldr/action.yml is now the only zackees/setup-soldr@v0 call site (ci-lint CACHE-009/RUST-001). It fixes the inputs every job must share:

  • one Soldr runtime (version: 0.9.23);
  • cook-delta: false.

  Its required save-cache input is passed straight through. cache-key-pr is appended to cache-key-suffix only when the step saves, so a PR-context save would carry pr-<N> (CACHE-013).

• Plan-driven saves. linux and dylints now run ci_lint plan --github-output before setup-soldr, and feed its cache_save/cache_key_pr into the wrapper:

  • cache_save is true only on a main push, which is exactly the old github.event_name == 'push' policy;
  • linux exports both values as job outputs for build, test, full-coverage and cache-retention;
  • the plan step now passes --sha, so a workflow_dispatch run plans instead of failing on the missing SHA.

  Release, crates publish and the nightly macOS guest pass "false", because they never wrote caches.

• setup-uv. Every step states save-cache:

  • plan-driven, or push-only in the two jobs where it runs before the plan exists;
  • literal false in the release workflows and the nightly guest;
  • cache-suffix carries pr-<N> in PR context.

• ci.toml.

  • [allow].setup-soldr.require.save-cache = "plan" and [allow].setup-uv.require.save-cache = "plan".
  • One dated [[exceptions]] entry for RUST-013, the runtime pin, which ci/test_cache_policy.py already guards as SOLDR_RUNTIME_VERSION. Its bump path is in kernal-api: retire the RUST-013 soldr runtime pin exception ci.yml#130. docs/ci-toml.md names this form of exception as the sanctioned one for RUST-013.

• Tests. ci/test_cache_policy.py now parses the wrapper calls and merges in the wrapper's fixed inputs, and gains test_only_the_wrapper_calls_setup_soldr. test_auto_release.py and test_native_proof_jobs.py follow the wrapper too.

Evidence: ci_lint precheck --local at ci.yml@78506e7 (main 92446a5 -> this branch)

rule	before	after
CACHE-009	7	0
RUST-001	7	0
CACHE-013	13	0
RUST-013	7	0 (1 approved_exception)
violations	944	910

Local: the CI guard suite (127 tests), test_auto_release.py and the other release tests all pass.

Not done

• ci.toml's cache families and budget are unchanged here. That work is kernal-api: fit the declared cache model inside the 10GB cap ci.yml#93, the next PR.