[codeandsolder]

Ports the existing Woodpecker coverage to GitHub Actions, fixes the false-green browser path that the migration exposed, and tunes the expensive Rust jobs for GitHub-hosted runners.

Coverage:

• rustfmt + Leptos view formatting, with git diff --exit-code so formatter changes cannot false-green
• native Clippy with -D warnings across the workspace plus SSR/OTel feature configurations
• parallel WASM hydration checks for live-search and i18n-demo
• workspace library tests
• cargo audit against the committed lockfile
• production cargo leptos builds plus explicit Stylance CSS generation
• all three Docker image builds in parallel
• testcontainers + chromiumoxide E2E via scripts/test-e2e.sh, using Chrome from the ubuntu-24.04 runner

Correctness fixes uncovered while making CI meaningful:

• E2E now builds and serves the canonical wasm-bindgen hydration assets instead of aliases that could let the browser path false-green
• Leptos hydration entry points use the normal exported hydrate function expected by the generated loader
• the live-search SSE client subscribes to the named connected event and does not treat transport-level EventSource::Open as the application handshake

CI performance:

• Clippy persists its incremental target/debug state; warm Clippy dropped from ~14m18s to ~16s of linting
• unit tests, production builds, and E2E use pinned sccache with per-job local caches persisted through actions/cache; observed warm compiler hit rates are effectively 100%
• helper binaries (leptosfmt, cargo-leptos, Stylance, wasm-bindgen CLI, and cargo-audit) are version-pinned and cached
• Docker builds run as a three-way matrix and use cargo-chef plus per-image BuildKit GitHub Actions layer caches
• Docker cargo-chef and final builds are forced onto the repository's Rust 1.94.0 compiler identity so copying rust-toolchain.toml cannot invalidate cooked dependencies
• gateway's source-change validation recompiles only local workspace crates after cargo chef cook; a same-commit warm rerun hits every Docker build layer, including the final Rust build
• Docker GHA cache export dropped from ~116s while seeding the new gateway cache to ~2.8s on the warm rerun
• Docker intentionally does not use an sccache cache mount: BuildKit exec-cache mounts are local to the builder and are not the persistent GHA layer cache we need on ephemeral hosted runners

The non-Docker sccache stores intentionally use local-disk mode rather than sccache's GHA object backend: archiving each per-job cache once avoids contention between parallel jobs while preserving compiler-cache reuse.

Rust follows the repository's pinned 1.94.0 toolchain. CI helper binaries are installed with the runner's stable toolchain so their own MSRV does not accidentally raise the project's MSRV.

CI correctness and warm-cache behavior have now been validated on the PR itself. The PR is ready for review and is intentionally not auto-merged.