Bind package compiler-cache finalization to the owning process

[TheGreenCedar]

Context

Frozen-candidate qualification run 30487492458 built the Linux package successfully inside the pinned glibc container, where /sccache/sccache --show-stats and --stop-server both succeeded. The later host Finalize compiler objects step then tried to stop a host sccache server that never compiled anything and failed with connection refused.

The regression entered when the Linux host qualification-driver build was removed but the host finalizer was broadened to every successful Linux container build. This is a deterministic workflow ownership error, not an external runner failure.

Acceptance

• Keep Linux cache statistics and shutdown strict inside the container that owns the Linux compiler server.
• Run the host Finalize compiler objects step only after the host-native package build that owns that server.
• Preserve strict host finalization for macOS and Windows; do not use continue-on-error, || true, or an advisory stop.
• Update workflow policy and hostile mutation tests so reintroducing Linux into the host finalizer, removing the container stop, or weakening the host stop is rejected.
• Run workflow policy tests, the policy validator, claim-graph validation, actionlint, and one accepted exact-head source proof before integration.

This does not change the job DAG, package matrix, evidence cells, or release claim graph.

Refs #1597