ci: cache discipline, slim CI debug info, and a --locked sweep - #703

A PR touching only .config/nextest.toml (e.g. a future profile edit)
must re-run the tests that consume it; this PR's own run only triggered
because it also edited the core-tests composite.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Four changes, one review story (nextest archive, unified session e2e,
scripts over YAML, composite verify):

- nextest archive replaces the hand-rolled testbins.json + run-testbin.sh:
  build-linux ships testbed/nextest-archive.tar.zst and the test job
  selects harnesses with filtersets under the new profile.vm (one VM at
  a time, hung boots hard-killed at 6 min, no retries - a same-invocation
  retry runs against the leaked vmm/gvproxy of the failed attempt, #588).
- the unified session e2e (scripts/session-e2e.sh) joins the lane,
  covering Deployment Model 3 (native Linux + VM): the minimal CLI is
  built in build-linux (separate invocation - a combined build unifies
  libkrun into the CLI, the #694 regression class), ships in the
  testbed, and drives activate/exec/destroy from PATH, with the #588
  reap (sudo: relay leftovers are root-owned) before it and
  cli-e2e-boot.log uploaded.
- the daemon-lifecycle shell blob becomes scripts/lifecycle-e2e.sh:
  PATH-resolved minvmd (no cargo, macOS-reusable), temp workdir, and an
  EXIT-trap teardown so a failed assert cannot strand a daemon.
- the krun_add_disk3 export assert moves into setup-libkrun-linux,
  mirroring the macOS composite and covering release.yml (which uses the
  composite but had no check); an early actionable failure - minvmd's
  compile-time link is the real backstop.

Also per owner direction: workflow comments drop PR/issue and R-numbers
(history belongs in commits, not YAML), and the DM labels are corrected
against docs/specs/03-spec-networking (DM1 is the macOS model; this
lane is DM3, session-e2e.sh header fixed accordingly).

Refs: #687

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The lifecycle step spawns a fresh daemon just like the CLI session e2e,
so it was equally exposed to leaked __krun-vmm/gvproxy children from a
failed harness run. Move the reap to run immediately after the harness
e2es, ahead of both fresh-daemon steps.

Addresses CodeRabbit review on #702.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Three cross-lane changes that must fork every cache exactly once:

- rust-cache gains shared-key (one per job class that compiles the same
  artifacts: workspace/tests/clippy/native-e2e/mac-unit) and save-if
  restricted to main, via new setup-rust inputs forwarded from
  core-tests. PR branches restore but never write, so PR churn stops
  LRU-evicting the main caches every PR restores from (the 10 GB pool
  is shared repo-wide).
- the two multi-GB raw actions/cache users (KVM build-linux, macOS
  artifacts stage2) split into cache/restore + main-only cache/save
  guarded on cache-hit.
- CARGO_PROFILE_DEV_DEBUG=line-tables-only in CI (setup-rust env step;
  explicit job env on the mac and KVM jobs that bypass the composite):
  usable backtraces, smaller target trees and caches, faster links -
  without a named Cargo profile, which would move output out of
  target/debug and break codesign/testbed/justfile paths.
- --locked on every workflow cargo invocation (build/test/clippy/
  archive), so a stale Cargo.lock fails loudly instead of silently
  re-resolving; previously only core-tests' cargo fetch enforced it.

Refs: #687

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>