ci: SHA-pin Swatinem/rust-cache + cache-on-failure:false + shared-cache:true

[Senorespecial]

Summary

Replaces the moving major tag Swatinem/rust-cache@v2 with the SHA of v2.9.1 (23869a5b) and adds:

• cache-on-failure: false – never persist a poisoned cache from a failed job; the warm-cache vector was the leading hypothesis for why PR ci: pin rust-toolchain action to @v1 and pass toolchain: 1.84.1 explicitly #35 kept failing identically across two clean runs (failing with target triple in channel name).
• shared-cache: true – reuse the main-branch cache for PR builds so warm caches start from a known-good baseline rather than a fresh per-PR reproduction.

Diagnostic Eviction

After #34 (--locked) and #35 (dtolnay/rust-toolchain@v1 + with.toolchain:1.84.1), PR #35\u2019s CI still produces the same canonical error across two consecutive clean runs (runs 27946370482 and 27946703145). That rules out a pure transient cache hit on the toolchain action. The remaining surface is the cache layer itself persisting a poisoned rustup state across jobs and PRs.

This PR pins the cache action to a known-good release SHA and turns off the failure-time cache save so a broken cache can no longer survive between jobs.

Companion PRs

• Builds on ci: pin rust-toolchain action to @v1 and pass toolchain: 1.84.1 explicitly #35 (Senorespecial:fix/ci/rust-toolchain-v1) – toolchain-action pin
• Validates ci: enforce --locked on workspace cargo invocations #34 (Senorespecial:fix/ci/lockfile-locked) – --locked semantics were never actually exercised in CI due to this same upstream blocker; once the cache is clean they should run end-to-end
• Closes ci: install of cargo-audit errors out with stable-x86_64-pc-windows-msvc on ubuntu-latest — wire rust-toolchain channel for runners to stable-x86_64-unknown-linux-gnu #33 (Octo-Protocol-org/Octo-Protocol#33) – the diagnosis captured there

Verification

Once this merges, PR #34 and PR #35 should flip green end-to-end, which would finally exercise cargo test --workspace --locked and cargo clippy --workspace --all-targets --locked -- -D warnings in CI (the lockfile-parity gap). PR #31 (feat/dashboard/sponsor-card) is also gated on the same upstream CI blocker.

Risk

• Action SHA stays reproducible – pinning to 23869a5b (v2.9.1) locks the cache action\u2019s behaviour to a known-good release, eliminating the moving-major-tag drift risk that bit ci: pin rust-toolchain action to @v1 and pass toolchain: 1.84.1 explicitly #35.
• shared-cache: true increases cache hit rate but also broadens the keys; combined with cache-on-failure: false we\u2019re protected from poisoning but PRs will now share the main-branch cache, which is the intended behaviour for fast PR builds.