ci: cache exact Playwright browser downloads

[leej3]

AI-generated draft — not reviewed by John

Summary

• restore Playwright browser binaries for test-all using an exact cache key
• distinguish runner label, architecture, Chromium/WebKit set, npm lock, and
  the macOS compatibility installer in that key
• allow pull requests to read the default branch's cache, but save only after
  a successful default-branch push
• bound reusable consumer jobs to 60 minutes

Rationale

Consumer PR #15 exposed an unbounded Linux stall during
playwright install --with-deps webkit. Playwright notes that restoring browser
binaries may take about as long as downloading them, and Linux host packages
still cannot be cached. This change is therefore deliberately conservative:
it reduces repeated CDN traffic without making cache availability part of the
correctness contract.

The cache has no fallback keys and no cross-OS reuse. Pull requests cannot
publish merge-ref-scoped browser caches, which avoids duplicating hundreds of
megabytes for every review branch. Cache misses continue through the existing
locked installation path.

The 60-minute job bound does not diagnose the current stall, but prevents a
browser or package-manager hang from consuming GitHub's six-hour default.

Verification

• pixi run test — 50 engine and 40 development tests
• workflow YAML parse and exact cache-order/condition assertions
• pixi run check-format
• git diff --check

Follow-up

The terminal Linux log from consumer PR #15 should determine whether the
WebKit operation is blocked in apt host dependencies or browser download. If
needed, a separate template change can split those phases for clearer timing;
this PR does not weaken --with-deps or browser coverage.

[leej3]

AI-generated draft — not reviewed by John

The cancelled consumer Linux log now isolates the original stall. Chromium and
all non-WebKit gates had passed; playwright install --with-deps webkit entered
apt-get update, retried the Ubuntu Azure mirror, fell back to
archive.ubuntu.com, and then produced no output for 34 minutes. It never
started a WebKit browser download.

This PR now addresses both resource boundaries:

• exact browser binaries may be restored from a portable cache, excluding
  Playwright's absolute-path .links/ state;
• cache restore/save are best-effort and cache download segments are bounded
  to five minutes;
• only successful default-branch pushes save browser caches;
• Linux test-all configures three apt retries with 30-second HTTP/HTTPS
  timeouts before Playwright installs required host packages;
• the whole reusable job is bounded to 60 minutes.

The final exact head is 8d5a6f5c7083e1966dfb32cc2197e0d7263d10a4.
Hosted engineering CI is green on Linux and macOS:
https://github.com/con/orinoco-lite-dev/actions/runs/32162776619

The cache and apt behavior itself still needs one downstream execution after
this reviewed workflow commit is pinned. Cache misses remain a supported path.