ci: reuse dependencies, split Linux lanes and share the Metal build

[vyncint]

Today

Ordinary CI takes about an hour, and almost none of it is tests. In run
34074441576
the macOS job spent 53m13s of its 54m12s in Cargo build/check phases; the
conformance step built for 14m28s and ran its one test in about a second.
Arrow and DataFusion compiled three times per job because each step selected
a different package set. Main CI was serialised behind the previous main run
(one run waited 54 minutes before its first job started), and the stress
matrix built the same release targets three times per OS.

Change

• Dependency caches (Swatinem/rust-cache, pinned to v2.9.2) on the Linux
  test lanes, the Metal job and stress. Workspace crates and installed tools
  are excluded; every Cargo command still runs after a restore. Release calls
  into ci.yml never restore or save a cache (clean defaults to true for
  workflow_call, and the step is also gated on github.workflow == 'CI').
• One dependency graph for the Metal lane. test-metal and
  test-metal-device share METAL_TEST_ARGS, which now includes the TUI
  package and uses oxidelake-runtime/metal so the same five packages resolve
  once. The device probe moved into the Makefile so make metal and CI are
  the same command.
• Linux tests split into three jobs (default / io-uring / predict), each
  keeping its companion checks (CUDA compile gate and coherence on default,
  no-second-CUDA on predict).
• Main CI cancels a superseded run. The release gate is excluded by
  workflow name; release.yml's own concurrency group is unchanged.
• Stress builds once per OS, then runs thread counts 1/4/16 with the same
  20/40/40 iteration split, via .github/scripts/stress-tui.py.
• Documentation-only changes skip the Rust jobs under an explicit allowlist
  (docs/**/*.md plus five root Markdown files). README.md, manifests,
  lockfile, workflows, scripts and anything unknown take the full gate.
  required-green moved to .github/scripts/ci-policy.py, which rejects any
  failure, cancellation, missing job or skip outside that policy.
• Cargo --timings reports are uploaded as timings-* artifacts (7 days) so
  the next round can be measured rather than guessed.
• make gate now matches CI: it runs MSRV, the full Metal lane on macOS,
  all-feature rustdoc and cargo deny --all-features, and the new
  make ci-scripts suite.
• Two small fixes found on the way: the crate-metadata gate used mapfile,
  which macOS's Bash 3.2 lacks, and make msrv now goes through rustup run
  so a standalone Cargo earlier on PATH cannot bypass the toolchain pin.

ADR-0017 records the decision and supersedes the no-cache comment in ci.yml.

Verified

• make ci-scripts (16 tests): gate policy, change classification with a
  real git repo (deletion, rename, newline in a path), stress coverage,
  Metal argument reuse, the metadata script under Bash 3.2, and make msrv
  with a non-proxy Cargo first on PATH.
• make zizmor at the pedantic persona: no findings.
• cargo tree --depth 0 on the shared Metal selection: compute, device,
  memory and runtime resolve [default,metal]; the TUI resolves []; the
  CUDA-only #[ignore] tests are cfg-gated out, so -- --ignored across
  the five packages runs exactly the conformance test it did before.
• make release-scripts crate-metadata metal on an Apple Silicon Mac: all
  green, and the -- --ignored pass ran gpu_backend_matches_datafusion_when_available
  once on the Metal device (1 passed, 6 filtered out); every other package
  reported 0 ignored tests selected.
• Action pins checked against upstream: Swatinem/rust-cache@6323deb… is
  the commit behind tag v2.9.2; actions/upload-artifact@ea165f8… is v4.6.2.

Not done

• No speed-up is claimed. The first cold run on main populates the
  caches; compare a warm run and a small-source-change run against the
  baseline above before setting a target.
• Clippy, MSRV and rustdoc stay uncached until cache size and eviction on the
  10 GB repository budget have been observed.
• Dependency opt-level, the TUI's dependency on DataFusion, and release
  binary parallelism are out of scope (audit items 6 and the release notes).