[zackees]

Summary

• Make the optional all-features matrix restore-only for durable Rust caches while retaining test coverage.
• Add a main-only, least-privilege workflow that waits for cache writers to settle, retires only the three disabled all-features cache families, and checks converged repository usage against 9.5 GB.
• Track the cache-budget regression under ci(cache): rust-cache saves on pull requests — 13.4 GB of unreachable PR-ref caches over the 10 GB limit; add save-if and guard it #1216.

The writer barrier checks the exact main SHA, inventories direct and reusable cache writers, fails closed on unknown statuses or main advancement, and leaves timeout headroom. No cache entries are manually deleted by this PR.

Validation: cache-budget tests (17), cache-save guard (11), Ruff, Black, YAML parse, and diff check pass. The full unittest suite has six pre-existing platform/environment failures reproduced unchanged on base (3 PTY process-already-started errors, 2 Windows-only creationflags on Linux, 1 installed package missing _abi_guard).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!