feat: stage bounded compiler cache archives

[haasonsaas]

Summary

• bake checksum-pinned sccache 0.16.0 into the standard runtime with a 48 MiB sandbox-local cache
• add strict path-preserving compiler-cache archive capture/restore helpers compatible with Foam identity v1
• add a locked-down root helper boundary so unprivileged workloads can restore atomically without gaining helper access
• route compiler-cache materialization only through the unprivileged profile; existing APEX destinations remain unchanged

Expected recurring cost delta: $0; uses the existing ephemeral workspace and job/materialization path.

Test plan

• cargo +1.95.0 fmt --all -- --check
• cargo +1.95.0 clippy --workspace --all-targets -- -D warnings
• cargo +1.95.0 test --workspace
• python3 scripts/test-deployment-images.py
• independent whole-task review: Ship

Rollout

Draft: capture upload/API plumbing and Foam client integration will be added before readiness.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​flate2@​1.1.9
	cargo/​tar@​0.4.46

View full report