feat(ci): add layered Rust and Node caches

[FL03]

Summary

• Add one local Rust cache action that layers sccache with Swatinem/rust-cache while excluding Cargo target directories.
• Wire every Rust setup step to the local cache in the same job, add npm caching before each npm ci, and preserve the WASI SDK cache.
• Add a structural CI contract gate, 10 mutation negatives, pin-policy coverage, eval cases/rubric, and cache behavior documentation.

Issues

• Follow-up from the Axiom v039-dev2 reliability sprint.

Test Plan

• python3 scripts/tests/test-ci-cache-contract.py (10 mutations rejected)
• python3 scripts/tests/test-check-github-actions.py -q (20/20)
• python3 scripts/check-github-actions.py
• SHELLCHECK_OPTS=--exclude=SC2016 actionlint -color .github/workflows/*.yml
• bash services/eval/evals/run_eval.sh --check-manifest
• git diff --check
• Independent Luna/max audit: GREEN, 0 Critical / 0 Important / 0 Minor
• Live paid eval lane. Kept pending because this sprint forbids the runner's default Opus route.

Commit: 347c0bdfc8a52286214bd81e1f398e7eff9b92b2