feat(ci): sccache everywhere a Rust job runs — one warm compile cache for the whole fleet

Backend = the existing RustFS (storage.unom.io, S3, region home-central;
LAN-pinned to home-central's address by ci-core's unbound so cache traffic
never hairpins the router). Repo secrets SCCACHE_ACCESS_KEY_ID/SECRET carry a
keypair scoped to the unom-ci-sccache bucket; keys embed compiler hash +
target + flags, so the Ubuntu, Fedora, cross-arm64 and MSVC universes share
one bucket without ever colliding.

Wired: ci (rust, rust-arm64), deb (all three), rpm, bench,
linux-client-screenshots, windows, windows-msix, windows-host.
CARGO_INCREMENTAL=0 alongside (sccache and incremental are mutually
exclusive, and incremental artifacts are what bloated the persistent Windows
target dirs anyway). The binary is baked into the builder images; a per-job
ensure-step (same pattern as the GTK4 packages step) keeps jobs green while
the running :latest predates the bake, and ensure-windows-toolchain.ps1
self-provisions sccache.exe on the Windows runner. windows-drivers stays
unwrapped (wdk-build owns its build env), arch/android/apple are follow-ups.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/deb.yml

@@ -64,6 +64,15 @@ env:
   REGISTRY: git.unom.io
   OWNER: unom
   COMPONENT: main
+  RUSTC_WRAPPER: sccache
+  SCCACHE_BUCKET: unom-ci-sccache
+  SCCACHE_ENDPOINT: https://storage.unom.io
+  SCCACHE_REGION: home-central
+  AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_ACCESS_KEY_ID }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_SECRET_ACCESS_KEY }}
+  # sccache and incremental compilation are mutually exclusive; CI wants the shared
+  # cache, dev boxes keep incremental.
+  CARGO_INCREMENTAL: "0"
 
 jobs:
   build-publish:
@@ -74,6 +83,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # Shared compile cache (sccache -> RustFS S3 over the LAN). Baked into the builder
+      # images; this fetch keeps the job green while the running :latest predates the bake.
+      - name: sccache (no-op once the image bakes it)
+        run: |
+          command -v sccache >/dev/null 2>&1 || {
+            curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
+              | tar -xz --wildcards --strip-components=1 -C /usr/local/bin '*/sccache'
+          }
+          sccache --version
+
       - name: Version + channel
         # vX.Y.Z tag -> X.Y.Z, published to the `stable` apt distribution (a real release).
         # A main push -> <next-minor>~ciN.g<sha>, published to the `canary` distribution: the '~' sorts
@@ -220,6 +239,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # Shared compile cache (sccache -> RustFS S3 over the LAN). Baked into the builder
+      # images; this fetch keeps the job green while the running :latest predates the bake.
+      - name: sccache (no-op once the image bakes it)
+        run: |
+          command -v sccache >/dev/null 2>&1 || {
+            curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
+              | tar -xz --wildcards --strip-components=1 -C /usr/local/bin '*/sccache'
+          }
+          sccache --version
+
       - name: Version + channel
         run: |
           git config --global --add safe.directory "$PWD"
@@ -327,6 +356,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # Shared compile cache (sccache -> RustFS S3 over the LAN). Baked into the builder
+      # images; this fetch keeps the job green while the running :latest predates the bake.
+      - name: sccache (no-op once the image bakes it)
+        run: |
+          command -v sccache >/dev/null 2>&1 || {
+            curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
+              | tar -xz --wildcards --strip-components=1 -C /usr/local/bin '*/sccache'
+          }
+          sccache --version
+
       # Byte-identical to build-publish's version step (pf-version.sh is deterministic per
       # commit), so the arm64 package always shares the amd64 version line.
       - name: Version + channel