ci(kache): connect hosted runners to shared MinIO

[jmagar]

Summary\n- add ephemeral S3 credential inputs to the local Kache setup action\n- connect hosted release validation and build jobs to the organization MinIO cache\n- preserve self-hosted runner configs and private endpoint behavior\n- keep credentialless runs on the current local-only fallback\n\n## Verification\n- YAML parse: pass\n- actionlint: pass\n- all three ubuntu-24.04 Kache callers provide the organization contract\n- cross-runner proof in dinglebear-ai/yarr PR #119: 100% hit rate, remote=1, errors=0, Kache gate OK\n- targeted gates used because generic Lefthook hooks exceed LABBY Code Mode's 30-second envelope\n\nBead: syslog-mcp-8sqjf

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[jmagar]

Closing as superseded and partly unsafe.

Superseded

The kache input changes here — s3-access-key, s3-secret-key, s3-endpoint, s3-bucket, s3-prefix, and the KACHE_S3_* env wiring in setup-rust-kache — are byte-identical to what #329 already carries, and #329 also covers the same docker-publish.yml and release.yml callers. Verified by diffing both branches against main.

The unique part should not land

The only content here that #329 does not have is this:

-        endpoint = "http://192.0.2.2:9000"
+        endpoint = "http://10.1.0.2:9000"
-          echo "kache remote: s3://kache/rust via Nashost MinIO"
+          echo "kache remote: s3://kache/rust via Tootie MinIO"

192.0.2.2 is RFC 5737 TEST-NET-1 — a documentation address — and "Nashost" is a placeholder name. Those are a deliberate scrub, not a bug: this repository is public, and there is an active chore/scrub-internal-identifiers effort across the fleet. This PR would republish the real internal LAN address and host name.

The endpoint does not need to be in source at all. Every caller passes ${{ vars.KACHE_S3_ENDPOINT }}, so the real value lives in org variables where it belongs. #329 was itself amended to drop a hardcoded hostname default for the same reason.

No functionality is lost by closing this — #329 delivers the hosted-runner kache connection without the exposure.