feat(ci): sccache everywhere a Rust job runs — one warm compile cache for the whole fleet

Backend = the existing RustFS (storage.unom.io, S3, region home-central;
LAN-pinned to home-central's address by ci-core's unbound so cache traffic
never hairpins the router). Repo secrets SCCACHE_ACCESS_KEY_ID/SECRET carry a
keypair scoped to the unom-ci-sccache bucket; keys embed compiler hash +
target + flags, so the Ubuntu, Fedora, cross-arm64 and MSVC universes share
one bucket without ever colliding.

Wired: ci (rust, rust-arm64), deb (all three), rpm, bench,
linux-client-screenshots, windows, windows-msix, windows-host.
CARGO_INCREMENTAL=0 alongside (sccache and incremental are mutually
exclusive, and incremental artifacts are what bloated the persistent Windows
target dirs anyway). The binary is baked into the builder images; a per-job
ensure-step (same pattern as the GTK4 packages step) keeps jobs green while
the running :latest predates the bake, and ensure-windows-toolchain.ps1
self-provisions sccache.exe on the Windows runner. windows-drivers stays
unwrapped (wdk-build owns its build env), arch/android/apple are follow-ups.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/ci/ensure-windows-toolchain.ps1

@@ -47,3 +47,19 @@ catch { Write-Warning "disk reclaim step failed (non-fatal): $_" }
 $ciDir = $PSScriptRoot
 & "$ciDir\provision-windows-wdk.ps1"
 & "$ciDir\provision-windows-punktfunk-extras.ps1"
+
+# --- sccache: shared compile cache (RustFS S3 over the LAN). The Windows workflows set
+# RUSTC_WRAPPER=sccache, so the binary must exist on any runner regardless of when the
+# template was last re-baked. GITHUB_PATH makes it visible to every later step.
+$sccacheDir = 'C:\Users\Public\sccache'
+$sccacheExe = Join-Path $sccacheDir 'sccache.exe'
+if (-not (Test-Path $sccacheExe)) {
+  $v = '0.10.0'
+  $tarball = Join-Path $env:TEMP "sccache-$v.tar.gz"
+  Invoke-WebRequest -Uri "https://github.com/mozilla/sccache/releases/download/v$v/sccache-v$v-x86_64-pc-windows-msvc.tar.gz" -OutFile $tarball
+  New-Item -ItemType Directory -Force -Path $sccacheDir | Out-Null
+  tar -xzf $tarball -C $sccacheDir --strip-components=1
+  Remove-Item $tarball -ErrorAction SilentlyContinue
+}
+& $sccacheExe --version
+if ($env:GITHUB_PATH) { Add-Content -Path $env:GITHUB_PATH -Value $sccacheDir }