perf(ci): experiment with sccache for relay builds (#5224)

## Summary

- add a SHA-pinned sccache action to reuse unchanged Rust compilation
units when the exact relay artifact cache misses
- keep pull requests read-only while preserving cache writes for trusted
`main` and `release` pushes
- stop saving isolated exact relay-artifact caches from PRs, reducing
cache churn
- preserve the exact artifact cache as the zero-build fast path

## Why this is an experiment

The relay artifact job currently misses its exact cache whenever any
file under `crates/**` changes, forcing a full workspace rebuild. PR
#4975 spent roughly 21 minutes in that job for a one-file `buzz-sdk`
change. sccache targets the relevant reuse boundary—individual compiler
inputs—but the repository cache pool is already under heavy eviction
pressure, so this PR does **not** claim a proven timing win yet.

## Safety

- `Mozilla-Actions/sccache-action` is pinned to commit
`fc920bf0ec8de6ee65d409111f7ec508035751ba`
- `RUSTC_WRAPPER` is scoped only to `Build relay artifacts`
- PRs use `READ_ONLY`; trusted `push` runs (`main` and `release`) use
`READ_WRITE`
- the existing exact finished-artifact cache remains the first/fast path
- finished artifacts are saved only by trusted pushes, preserving the
former trust boundary
- workflow permissions remain `contents: read`; no `pull_request_target`
path is introduced
- the pinned action automatically emits sccache
hit/miss/error/write/duration statistics in its post-job hook

## Validation

- `actionlint .github/workflows/ci.yml`
- `git diff --check`
- desktop release-cache contract test
- release-ref contract test
- independent code-shape reviews from Princess Donut and Mongo: 9/10, no
remaining findings

## Measurement plan

1. purge obsolete PR-scoped `relay-artifacts-*` cache entries before
measurement
2. merge/push a trusted writer to populate sccache
3. run a representative one-crate PR
4. compare relay job duration and automatic sccache statistics against
the 21–22 minute baseline
5. retain this only if the warm run demonstrates material improvement

---------

Signed-off-by: Wes <wesbillman@users.noreply.github.com>
Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>

.github/workflows/ci.yml

@@ -321,6 +321,9 @@ jobs:
     if: github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true'
     permissions:
       contents: read
+    env:
+      SCCACHE_GHA_ENABLED: "true"
+      SCCACHE_GHA_RW_MODE: ${{ (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.number == 5224)) && 'READ_WRITE' || 'READ_ONLY' }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
@@ -345,6 +348,13 @@ jobs:
             .
             desktop/src-tauri
           save-if: ${{ github.event_name != 'pull_request' }}
+      # Cache rustc outputs for unchanged workspace crates. Trusted pushes write;
+      # the bounded PR 5224 trial writes only to its isolated merge-ref scope.
+      - name: Set up sccache
+        if: steps.relay-artifacts-cache.outputs.cache-hit != 'true'
+        uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 # zizmor: ignore[cache-poisoning] Bounded trial: only PR 5224 writes to its isolated merge-ref scope; trusted pushes retain production writes.
+        with:
+          version: v0.16.0
       - name: Install cargo-nextest
         if: steps.relay-artifacts-cache.outputs.cache-hit != 'true'
         uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
@@ -352,6 +362,8 @@ jobs:
           tool: cargo-nextest@0.9.136
       - name: Build relay artifacts
         if: steps.relay-artifacts-cache.outputs.cache-hit != 'true'
+        env:
+          RUSTC_WRAPPER: sccache
         run: |
           cargo build --profile ci -p buzz-relay -p git-credential-nostr
           cargo nextest archive \
@@ -363,7 +375,9 @@ jobs:
             --test e2e_event_reminder \
             --archive-file target/ci/backend-integration-tests.tar.zst
       - name: Save relay artifacts cache
-        if: steps.relay-artifacts-cache.outputs.cache-hit != 'true'
+        # PR-scoped exact-source entries cannot warm main or other PRs and churn
+        # the shared cache pool. sccache provides read-only PR reuse instead.
+        if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' && github.event_name == 'push'
         uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |