fix(packaging/arch): correct pacman setup — import the registry key, cache cargo git

The Gitea Arch registry signs its DB + packages, so 'SigLevel = Optional TrustAll' fails
non-interactively (pacman still needs the key to verify). Document the one-time
pacman-key import instead; install is then signature-validated under pacman's default
SigLevel (verified end-to-end: clean archlinux container -> repo sync -> install,
'Validated By: Signature').

Also cache /usr/local/cargo/git in arch.yml: the workspace pulls clients/windows'
git-pinned windows-reactor/windows deps to resolve, cloning windows-rs (huge) every run
otherwise — same registry+git cache deb.yml uses.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/arch.yml

@@ -52,9 +52,15 @@ jobs:
 
       - uses: actions/checkout@v4
 
+      # Cache cargo's git dir too, not just the registry: the workspace includes
+      # clients/windows, whose windows-reactor/windows deps are git-pinned — cargo must CLONE
+      # them (windows-rs is huge) merely to resolve the workspace, even though nothing Windows
+      # is ever compiled here. Cached, that cost is paid once per runner.
       - uses: actions/cache@v4
         with:
-          path: /usr/local/cargo/registry
+          path: |
+            /usr/local/cargo/registry
+            /usr/local/cargo/git
           key: cargo-home-arch-${{ hashFiles('Cargo.lock') }}
           restore-keys: cargo-home-arch-