ci: keep CARGO_HOME outside the checkout so root Rust caches save

Hermit's rustup package sets CARGO_HOME to ${HERMIT_ENV}/.hermit/rust.
Swatinem/rust-cache keeps only target/ outputs for packages whose manifest
is outside the workspace root, so every registry crate looked like a
workspace member and each root-workspace cache saved an empty target/
(1303 B on main for unit-tests, rust-lint, cross, relay-e2e, and mesh
lifecycle). The exact-key hit then blocked every later save.

Set CARGO_HOME to ${HOME}/.cargo-hermit (and its bin/ on PATH) in
bin/hermit.hcl. Hermit applies that env whenever it execs cargo, so a
workflow-level CARGO_HOME export cannot do this; the environment config
fixes CI and local alike. The rust-cache contract pins it, and
bin/hermit.hcl now selects the Rust CI lanes.

Consolidate the default-feature just test-unit nextest runs into one
invocation with per-package filter clauses, so shared dependencies compile
once. Feature-flagged runs and doctests stay separate.

Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>

scripts/test-rust-cache-contract-regressions.sh

@@ -12,6 +12,8 @@ for workflow in "$root"/.github/workflows/*.yaml; do
   cp "$workflow" "$tmp/.github/workflows/"
 done
 cp "$root/renovate.json" "$tmp/renovate.json"
+mkdir -p "$tmp/bin"
+cp "$root/bin/hermit.hcl" "$tmp/bin/hermit.hcl"
 
 run_contract() {
   BUZZ_RUST_CACHE_CONTRACT_ROOT="$tmp" "$root/scripts/test-rust-cache-contract.sh"
@@ -139,6 +141,32 @@ YAML
 run_contract >/dev/null
 rm -rf "$tmp/.github/actions" "$tmp/.github/workflows/new-cache-user.yaml"
 
+write_hermit_config() {
+  cat > "$tmp/bin/hermit.hcl"
+}
+
+write_hermit_config <<'HCL'
+manage-git = true
+HCL
+expect_failure 'bin/hermit.hcl must set CARGO_HOME once'
+
+write_hermit_config <<'HCL'
+env = {
+  "CARGO_HOME": "${HERMIT_ENV}/.cargo",
+  "PATH": "${HERMIT_ENV}/.cargo/bin:${PATH}",
+}
+HCL
+expect_failure 'bin/hermit.hcl must set CARGO_HOME once'
+
+write_hermit_config <<'HCL'
+env = {
+  "CARGO_HOME": "${HOME}/.cargo-hermit",
+}
+HCL
+expect_failure 'must put ${HOME}/.cargo-hermit/bin on PATH'
+cp "$root/bin/hermit.hcl" "$tmp/bin/hermit.hcl"
+run_contract >/dev/null
+
 python3 - "$tmp/.github/workflows/_ci-rust.yml" <<'PY'
 import pathlib
 import sys

scripts/test-rust-cache-contract.sh

@@ -91,6 +91,23 @@ cache_uses.each do |path, location, ref|
   end
 end
 
+# Hermit's rustup package defaults CARGO_HOME to ${HERMIT_ENV}/.hermit/rust.
+# rust-cache keeps only target/ outputs whose manifest is outside the workspace
+# root, so a registry under the checkout makes every dependency look like a
+# workspace member: the root-workspace cache saves an empty target/ and the
+# exact-key hit then blocks every later save. Hermit's environment env wins
+# over a CARGO_HOME exported by a workflow step, so the fix has to live here.
+hermit_config = (root / "bin" / "hermit.hcl").read.force_encoding("UTF-8")
+cargo_home = hermit_config.scan(/^\s*"?CARGO_HOME"?\s*[:=]\s*"([^"]*)"/).flatten
+unless cargo_home.length == 1 && cargo_home.first.start_with?("${HOME}/") &&
+    !cargo_home.first.include?("HERMIT_ENV")
+  abort "bin/hermit.hcl must set CARGO_HOME once to a ${HOME}/ path outside the checkout"
+end
+cargo_bin = "#{cargo_home.first}/bin"
+unless hermit_config.match?(/^\s*"?PATH"?\s*[:=]\s*"#{Regexp.escape(cargo_bin)}:\$\{PATH\}"/)
+  abort "bin/hermit.hcl must put #{cargo_bin} on PATH"
+end
+
 rust_ci_path = root / ".github" / "workflows" / "_ci-rust.yml"
 rust_ci = workflows.fetch(rust_ci_path) { load_workflow.call(rust_ci_path) }
 jobs = rust_ci["jobs"]