Restore scoped OpenSecret EIF caches

[AnthonyRonning]

Summary

Follow up on #905 to restore the missing EIF binary-cache setup without granting OIDC to PR code or extending the timeout.

• Restore the pinned FlakeHub cache action and explicit Determinate Nix installation in a separate trusted-master push/manual job with job-scoped id-token: write.
• Enable GitHub caching alongside FlakeHub and diff-store: true, so substituted paths also warm the default-branch cache for unprivileged checks.
• Keep PRs, including forks, and non-master manual runs without OIDC. Use the pinned underlying Magic Nix Cache action with FlakeHub disabled and GitHub branch-scoped caching enabled.
• Preserve approval-edit-only PR comparisons, relevant-master routing, independent dev/prod jobs, checkout credential restrictions, and the 90-minute limit. Do not change kernel/build inputs, lockfiles, PCR approvals/history, signing, or deployment configuration.
• Add regression coverage for cache setup/order, permission boundaries, event/ref routing, cancellation, and cache warming. Update the guides and skills with cold-run verification and cache-access boundaries.

Root cause

Both EIF jobs in master run 34563284787 timed out while cold-building the custom Linux 6.12.101 kernel. They fetched only from cache.nixos.org. The legacy workflow had fetched the identical kernel output from FlakeHub. Warm local builds and intentionally skipped PR EIF checks did not reveal this regression.

Validation

• 61 focused routing/workflow/helper tests passed, plus actionlint.
• All 10 root aarch64-linux Nix checks passed with credential variables excluded; other systems were omitted.
• Normal pre-commit hook passed frontend formatting, build, and 818 tests (0 failures).
• git diff --check passed. Verified unchanged approval/lockfile hashes, protected-file metadata, dependency pins, saved EIF hashes, and dev/prod output selection. Output evaluation is not a new EIF build.

Hosted verification still required

FlakeHub cache access is repository/organization-scoped. This change does not grant Maple access to legacy OpenSecretCloud cache entries. A fresh trusted-master ARM64 run must confirm authentication, actual custom-kernel substitution, timing, cache warming, and eventual PCR comparison. Then verify unprivileged reuse of the warmed GitHub cache. Cache-access or population work may require a separate operator checkpoint.

This PR does not edit approved PCR JSON, so its EIF comparisons should intentionally skip. Ordinary PR CI and local tests do not establish restored hosted build times. Expected mismatches against the existing approvals must remain visible; do not sign or update approvals to clear CI. No merge, manual workflow dispatch, cache-access grant, PCR publication, or deployment is part of this PR creation.