ci: add bounded ccache to C++ workflows

[andrescera]

Affected repo & language: CERALIVE/srt — GitHub Actions YAML for C/C++ builds

What

Add bounded ccache restore coverage to every ordinary C/C++ build workflow: ABI current/base, Android NDK r23, C++03/C++11 Linux, macOS, Windows, iOS, Debian runtime/release packaging, and s390x. Cache keys separate platform, purpose, and matrix dimensions and hash the compiled inputs. Pull requests are restore-only; successful trusted runs save caches. Windows now uses Ninja under an explicit x64 MSVC developer environment so CMake compiler launchers work. CodeQL remains intentionally uncached so compiler tracing is not bypassed.

Why

These workflows repeatedly rebuild the same translation units across compatible runs. A consistent 200 MB cache contract reduces that work without changing source, test expectations, ABI checks, package verification, or release gates.

How to verify

• Let every hosted PR check complete, especially C++03, Linux/macOS/Windows C++11, Android, iOS, ABI, s390x, and runtime packaging.
• Run Actionlint and parse every file under .github/workflows/ as YAML.
• Confirm every compile workflow has matching actions/cache/restore@v6 and trusted-event actions/cache/save@v6 keys, both CMake compiler launchers, a 200 MB cap, and cache statistics.
• Run a clean CMake build and complete CTest suite with an empty cache, then repeat from a fresh build tree against the populated cache.
• Run packaging/build-deb.sh, packaging/package-contract.sh, and packaging/verify-runtime-replacement.sh through the Docker-mounted cache path.

Risks

The first trusted run for each cache namespace is cold. Windows changes from the Visual Studio generator to Ninja while retaining the x64 MSVC toolchain, Release configuration, exclusions, and test command. Cache keys isolate incompatible targets, PRs cannot persist compiler output, and every archive is capped at 200 MB. The release workflow remains dispatch-only and publication still depends on the complete verified build matrix.

---

Checklist

• Docs updated if behavior or structure changed (Rule A: AGENTS.md)
• Started from updated main; branch rebased on latest canonical branch (Rule B)
• Rule D local-scratch reference check passes for tracked files
• Tests pass; QA evidence recorded