infra: make thin-v6 candidate builds immutable

[reinhold-ph]

Why

The thin-v6 candidate workflow currently packages on every branch push, uses a source-insensitive immutable Cargo cache key, and saves caches even after failed runs. That makes iteration expensive and can freeze a stale compile cache.

Architecture

• Make candidate packaging manual and require a full 40-character source SHA.
• Run a cheap preflight that proves source CI passed for that exact SHA before allocating macOS.
• Use the verified SHA for checkout, concurrency, manifest, archive, and artifact identity.
• Separate Cargo downloads from compiler outputs.
• Key compiler outputs by source SHA while allowing compatible incremental restores.
• Save pnpm and Cargo caches only after complete success.
• Publish cache hit/restored-key telemetry in the Actions summary.
• Validate these rules in a dedicated two-minute, path-scoped workflow so workflow-only PRs do not trigger unrelated product builds.

Scope

This PR changes workflow/process files only. It does not change Buzz runtime behavior, Fizz activation, skill loading, signing, installation, or release behavior.

Changed paths:

• .github/workflows/thin-v6-macos-arm64.yml
• .github/workflows/thin-v6-workflow-contract.yml
• scripts/test-thin-v6-workflow-efficiency.sh

Verification

• Dedicated GitHub workflow contract passed in 8 seconds: https://github.com/Peakhunter/buzz/actions/runs/31389641088
• scripts/test-thin-v6-workflow-efficiency.sh
• scripts/test-desktop-release-cache-workflow.sh
• scripts/test-signed-canary-contract.sh
• YAML parse validation
• Workflow structure and pinned-action validation
• git diff --check

The initial PR revision edited ci.yml, which caused unrelated product jobs to run and exposed pre-existing Tauri formatting failures on the feature base. The follow-up removes that ci.yml edit and isolates this contract; no product files were reformatted.

Gates not crossed

No candidate build was dispatched. Nothing was signed, installed, published, released, or tested on the Mac.

Review identity

Head: b6b7b63a33a6a778307d969dae15e963aae73310