feat(cache): --cargo-cache flag and [cargo_cache] config section

Default on, because the cache is safe by construction rather than by
convention: it engages only where a Cargo.lock exists, and refuses to publish
anything the prune assertion cannot vouch for. Two independent off switches --
the flag for one job, `enabled = false` for the host.

The store root is resolved after the environment overrides are applied, so
CI_ROOT relocates it along with everything else, while an explicit root in the
config still wins. Both directions are covered by tests.

Also asserts that the Windows branch never receives the argument at all: the
cache is Linux-only and the two branches stay separate, per AGENTS.md.

tests/python/test_config.py

@@ -145,3 +145,54 @@ def test_ip_pool_absent_when_not_configured(tmp_path: Path) -> None:
     toml.write_text("[backend]\ntype = \"workstation\"\n", encoding="utf-8")
     cfg = load_config(config_path=toml, env={})
     assert cfg.ip_pool is None
+
+
+# ── cargo cache section ──────────────────────────────────────────────────────
+
+
+def _paths_only(tmp_path: Path, extra: str = "") -> Path:
+    cfg = tmp_path / "config.toml"
+    cfg.write_text(
+        '[paths]\nroot = "/var/lib/ci"\ntemplates = "/var/lib/ci/templates"\n'
+        'build_vms = "/var/lib/ci/build-vms"\nartifacts = "/var/lib/ci/artifacts"\n'
+        'keys = "/var/lib/ci/keys"\n' + extra,
+        encoding="utf-8",
+    )
+    return cfg
+
+
+def test_cargo_cache_defaults_under_paths_root(tmp_path: Path) -> None:
+    cfg = load_config(config_path=_paths_only(tmp_path), env={})
+    assert cfg.cargo_cache.enabled is True
+    assert cfg.cargo_cache.root == Path("/var/lib/ci/cache/cargo")
+    assert cfg.cargo_cache.retention_days == 30
+
+
+def test_cargo_cache_section_overrides_the_defaults(tmp_path: Path) -> None:
+    cfg = load_config(
+        config_path=_paths_only(
+            tmp_path,
+            '\n[cargo_cache]\nenabled = false\nroot = "/mnt/fast/cargo"\n'
+            "retention_days = 7\n",
+        ),
+        env={},
+    )
+    assert cfg.cargo_cache.enabled is False
+    assert cfg.cargo_cache.root == Path("/mnt/fast/cargo")
+    assert cfg.cargo_cache.retention_days == 7
+
+
+def test_cargo_cache_root_follows_ci_root_env(tmp_path: Path) -> None:
+    """CI_ROOT relocates every path; the store must move with them."""
+    cfg = load_config(
+        config_path=_paths_only(tmp_path), env={"CI_ROOT": str(tmp_path / "elsewhere")}
+    )
+    assert cfg.cargo_cache.root == tmp_path / "elsewhere" / "cache" / "cargo"
+
+
+def test_explicit_cargo_cache_root_beats_ci_root(tmp_path: Path) -> None:
+    cfg = load_config(
+        config_path=_paths_only(tmp_path, '\n[cargo_cache]\nroot = "/mnt/fast/cargo"\n'),
+        env={"CI_ROOT": str(tmp_path / "elsewhere")},
+    )
+    assert cfg.cargo_cache.root == Path("/mnt/fast/cargo")