#8290 ci: cache code runner validation builds

Summary

Cache the pinned Monty installation, Docker build stages, and Go compilation artifacts in code runner validation CI. Preserve the existing Rust, restricted-container, and Go integration checks while avoiding repeated compilation on warm runs.

Motivation

The observed validation run spent 6m 37s building Monty on the host and another 8m 13s building and smoke-testing the image, before Go integration tests began. The existing Rust dependency cache does not retain the installed Monty binary, and the local Docker build has no cross-run layer cache.

Technical details

• Key the Monty installation by its build script and Rust toolchain, without fallback keys. Keep its cache step after Rust setup so it saves before Rust cache cleanup.
• Build and load the smoke-test image with Buildx and a dedicated GitHub Actions cache scope; skip only the mise image-build dependency when running the existing smoke test.
• Cache Go modules and compiled packages, but use -count=1 so changes to external Rust/Monty executables cannot reuse a stale passing integration-test result.
• Cold runs still compile both runtimes; savings depend on populated caches.

---

Summary by cubic

Caches pinned Monty, Docker build stages, and Go compilation artifacts in the code runner validation workflow so warm runs skip repeated builds.

• Monty is cached by an exact key (build script and Rust toolchain); the cache saves right after Rust setup so the binary survives Rust cache cleanup.
• The smoke-test image is built and loaded with Buildx using a GitHub Actions cache scope; the smoke test itself always runs and skips only its build dependency.
• Go module and build caches use a restore key that falls back to the latest commit, but integration tests always run with -count=1 so stale external Rust/Monty executables can't pass.