fix(ci): cache the cargo registry, not the 16 GB target dir

The runner's 74 GB disk kept filling. Measured on the box: 24 GB of
act cache, 23.18 GB of it created in 20 days -- ~1.15 GB/day against a
30-day-unused / 90-day-used GC, so it could never converge.

Cause: src-tauri/target (16 GB locally: 9.6G debug, 3.2G release, 2.4G
android) was cached under five separate keys, all keyed on
hashFiles('**/Cargo.lock'). The release script stamps the version into
Cargo.lock, so all five invalidated on every chore(release) -- 32
distinct lockfile revisions in three months.

- Cache only registry/index, registry/cache and git/db. registry/src is
  omitted as well: cargo re-extracts it from the 155 MB of .crate
  tarballs rather than storing 1.1 GB extracted.
- Collapse the five per-job keys into one shared cargo-registry key.
  They existed to keep debug/release target artifacts from clobbering
  each other; with target uncached, registry contents are
  target-independent and every job wants the same crates.
- Split cargo-xwin into its own key. It tracks the xwin version in the
  builder image, not our lockfile, so keying it on Cargo.lock was
  re-downloading the whole Windows SDK on every release bump.
- CARGO_INCREMENTAL=0: never reused across runs, 3.5 GB of the debug dir.
- Installer artifact retention 30d -> 7d; tagged releases carry the
  binaries anyway.

Inflow drops from ~5 GB to ~150 MB per lockfile change. Tradeoff: Rust
jobs now compile cold every run (~31min vs ~9min on a cache hit for the
Linux release build). Most runs already paid that, since a release bump
invalidated every key. sccache with a hard size cap is the way back if
it bites.

.gitea/workflows/build-and-test.yml

@@ -13,6 +13,10 @@ on:
       - '**/*.md'
   workflow_dispatch:
 
+env:
+  # Incremental state is never reused between CI runs -- pure disk cost.
+  CARGO_INCREMENTAL: 0
+
 jobs:
   test:
     name: Run Tests
@@ -33,13 +37,22 @@ jobs:
       - name: Cache Rust dependencies
         uses: actions/cache@v3
         with:
+          # Registry only -- never src-tauri/target. That directory is ~16 GB and
+          # was cached under five separate keys, which filled the runner's 74 GB
+          # disk at ~1.15 GB/day (23 GB in 20 days, measured Aug 2026).
+          # registry/src is omitted too: cargo re-extracts it for free from
+          # registry/cache (155 MB of .crate tarballs vs 1.1 GB extracted).
           path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            src-tauri/target
-          key: ${{ runner.os }}-cargo-host-${{ hashFiles('**/Cargo.lock') }}
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+          # One shared key across every job. The old per-job keys existed to stop
+          # debug/release target artifacts clobbering each other; with target no
+          # longer cached, registry contents are target-independent, so all jobs
+          # want the same crates. First job to finish saves; the rest restore.
+          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-host-
+            ${{ runner.os }}-cargo-registry-
 
       - name: Cache Node dependencies
         uses: actions/cache@v3
@@ -129,13 +142,22 @@ jobs:
       - name: Cache Rust dependencies
         uses: actions/cache@v3
         with:
+          # Registry only -- never src-tauri/target. That directory is ~16 GB and
+          # was cached under five separate keys, which filled the runner's 74 GB
+          # disk at ~1.15 GB/day (23 GB in 20 days, measured Aug 2026).
+          # registry/src is omitted too: cargo re-extracts it for free from
+          # registry/cache (155 MB of .crate tarballs vs 1.1 GB extracted).
           path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            src-tauri/target
-          key: ${{ runner.os }}-cargo-android-${{ hashFiles('**/Cargo.lock') }}
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+          # One shared key across every job. The old per-job keys existed to stop
+          # debug/release target artifacts clobbering each other; with target no
+          # longer cached, registry contents are target-independent, so all jobs
+          # want the same crates. First job to finish saves; the rest restore.
+          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-android-
+            ${{ runner.os }}-cargo-registry-
 
       - name: Cache Node dependencies
         uses: actions/cache@v3