feat(ci): add trusted Kache runner opt-in

[jleni]

Summary

• give every Kache setup a job-scoped runtime directory
• use a simple job-local ${{ runner.temp }}/kache store for ordinary Linux jobs and preserve the native persistent macOS store
• expose a compatible Kache version plus stable manifest/namespace key
• add opt-in trusted node-cache routing to the restricted zondax-kache-linux scale set with a bounded 50 GiB store
• leave all existing callers on ordinary runners and local/S3 behavior by default

Rollout dependencies

Review now, but merge/advance v12 only after Kache 0.15.1 and kache-action#22/v1 are published. Enabling kache_node_cache additionally waits for the disk expansion and tenant-int-dev#95 deployment. The selected caller will pin the final reusable-workflow commit.

Validation

• exact-head YAML Checks green
• Ruby YAML parse
• Prettier/diff checks
• based on current origin/main containing fix(ci): colocate kache store with ephemeral workspaces #128

Part of kunobi-ninja/kache#811, #812, and #810.