Improve Rust cache reuse with revision-isolated target artifacts

[aram356]

Summary

• Reuse Cargo dependency sources and valid compiler results across application
  commits while keeping writable target artifacts revision-isolated.
• Add required-on-enable target-cache-revision, stable job-local build paths,
  strict local reuse guards, and cache hit/key/path diagnostics.
• Update EdgeZero consumers, adoption docs, regression tests, and real GitHub
  cache/native/WASM compiler reuse probes.

Changes

Crate / File	Change
setup-rust-build-cache/action.yml	New source-revision input and diagnostics; source keys remain stable; v2 target keys have no broad/legacy fallback.
setup-rust-build-cache/scripts/prepare.sh	Validate full lowercase SHA; always publish stable target directory; reject mixed revisions/workspaces, symlinks, and unowned or unreadable target contents.
Cache action tests	Cover failure-before-output, both caching modes, 40/64 SHA prefix collisions, changed lockfiles, local reuse, and unsafe paths/contents.
deploy-action.yml and deployment contracts	Pass each application's source SHA; test real exact-revision target restore and cross-revision source reuse/target miss; force native/WASM recompilation and require sccache hits.
build-app-cli/action.yml	Correct the directory handoff comment only; build invocation and credential scrubbing are unchanged.
Adoption guide and design/plan	Explain migration, cache layers, diagnostics, isolation, and performance limits.

Closes

Closes #416

Migration

Use a stable app-name (without the source SHA) and supply the resolved
application Git SHA as target-cache-revision when enabling target caching.
Missing/invalid required revisions fail: there is no compatibility fallback.
Target keys end in -<complete revision>-exact so a 40-character SHA cannot
implicitly prefix-match a 64-character SHA. First use of v2 target keys is cold.

cache-target: false disables remote target restore/save only; stable build
paths, dependency caching, and sccache remain enabled. Call setup once per
application/job; mixed-revision/workspace reuse is rejected.

No runtime, production/staging deployment, credential handling, CLI packaging,
or release verification behavior changes. No release or external deployer update
is included. Real-world timing improvements must be measured after adoption.

Test plan

• cargo test --workspace --all-targets: 1,520 passed, 0 failed, 1 ignored.
• cargo clippy --workspace --all-targets --all-features -- -D warnings.
• cargo fmt --all -- --check.
• cargo check --workspace --all-targets --features "fastly cloudflare spin".
• cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin.
• Cache action regressions and deployment contracts: 643 passed, 0 failed;
  five existing Linux-only checks skipped on macOS and run in PR CI.
• GitHub Environment and provider-neutral release contracts.
• Real checksum-verified sccache v0.16.0 probe: forced native and
  wasm32-wasip1 recompilations each produced a Rust cache hit, no cache errors.
• Actionlint, full ShellCheck, Zizmor offline security scan, action pin gate,
  and git diff --check.
• Docs: npm run format, npm run lint, npm run build.
• Independent design/plan/code review; reproduced and fixed the identified
  unowned-directory enumeration edge cases with red/green regressions.
• GitHub-hosted same-revision and new-revision cache smoke jobs passed in
  Deploy actions CI,
  including real source cache restore, target isolation and native/WASM compiler hits.
• Linux x86-64 release-packager contracts passed in PR static checks.

All PR checks for commit d37de722b53260afe422adf98d4dd853da2aa56e passed:
Deploy actions, Run Format, Run Tests, and CodeQL Advanced.

The locked docs install reported existing dependency audit advisories; this PR
does not change dependencies or their lockfile.

Checklist

• Changes follow CLAUDE.md conventions; isolated worktree and test-first
  regressions used.
• No dependencies or runtime crate code changed.
• New behavior has tests; no credentials committed.
• Stale cached root-level CLI packaging and provider-credential isolation
  protections are retained.