feat(action): cargo-cache input, cold on release tags

auto/on/off, defaulting to auto: branches and pull requests cache, refs/tags/v*
builds cold. furyrs asked for exactly that in thread #13 -- a tag run verifies
a release artifact rather than a change, so the clean room is worth two
minutes there and not elsewhere.

An unrecognised value throws instead of silently picking a side, the same
posture as the guest-os: 'Auto' fix: a cache setting that quietly means its
opposite is worse than a failed job.

Verified by running the shipped PowerShell block itself under pwsh across all
seven mode/ref combinations plus the invalid-mode throw, rather than by
reimplementing the logic in the test -- a reimplementation only checks the
model, not the code that ships.

.gitea/actions/local-ci-build/action.yml

@@ -194,6 +194,19 @@ inputs:
     required: false
     default: 'false'
 
+  cargo-cache:
+    description: >
+      Reuse compiled Rust dependency artifacts between jobs. "auto" (default)
+      caches on branches and pull requests but builds release tags
+      (refs/tags/v*) cold; "on" always caches; "off" never does. Only ever
+      engages for Linux guests whose workspace has a Cargo.lock, so it is inert
+      for every other job. Workspace crates are stripped from an entry before
+      it is stored and the job refuses to publish if any survive, so a restored
+      cache cannot carry the code under test -- but a release build verifies an
+      artifact rather than a change, so "auto" gives it the clean room.
+    required: false
+    default: 'auto'
+
   skip-artifact:
     description: >
       Set to "true" to skip artifact packaging and collection entirely.
@@ -249,6 +262,8 @@ runs:
         INPUT_REPO_COMMIT:           ${{ inputs.repo-commit }}
         INPUT_EXTRA_GUEST_ENV_JSON:  ${{ inputs.extra-guest-env-json }}
         INPUT_USE_SHARED_CACHE:      ${{ inputs.use-shared-cache }}
+        INPUT_CARGO_CACHE:           ${{ inputs.cargo-cache }}
+        GITHUB_REF_FOR_CACHE:        ${{ github.ref }}
         INPUT_SKIP_ARTIFACT:         ${{ inputs.skip-artifact }}
         INPUT_XVFB:                  ${{ inputs.xvfb }}
         INPUT_GUEST_CPU:             ${{ inputs.guest-cpu }}
@@ -387,6 +402,20 @@ runs:
         else { $pyArgs += '--use-git-clone' }
         if ($env:INPUT_USE_SHARED_CACHE -eq 'true') { $pyArgs += '--use-shared-cache' }
         if ($env:INPUT_SKIP_ARTIFACT    -eq 'true') { $pyArgs += '--skip-artifact' }
+        # Release tags build cold: they verify a release artifact, not a
+        # change, so the clean room is worth the two minutes (furyrs#13).
+        $cargoCacheMode = if ($env:INPUT_CARGO_CACHE) { $env:INPUT_CARGO_CACHE } else { 'auto' }
+        switch ($cargoCacheMode) {
+            'on'   { $useCargoCache = $true }
+            'off'  { $useCargoCache = $false }
+            'auto' { $useCargoCache = -not ($env:GITHUB_REF_FOR_CACHE -like 'refs/tags/v*') }
+            default {
+                throw ("cargo-cache must be one of 'auto', 'on', 'off' - got " +
+                       "'$cargoCacheMode'.")
+            }
+        }
+        if (-not $useCargoCache) { $pyArgs += '--no-cargo-cache' }
+        Write-Host ("[job] Cargo cache: " + $(if ($useCargoCache) { 'on' } else { 'off (cold)' }))
         if ($env:INPUT_XVFB             -eq 'true') { $pyArgs += '--xvfb' }
         # VMX overrides: forward only when > 0 (0 = keep template value).
         if ([int]($env:INPUT_GUEST_CPU)       -gt 0) { $pyArgs += @('--guest-cpu', $env:INPUT_GUEST_CPU) }