Bind package cache finalization to its owning process

[TheGreenCedar]

Context

Frozen-candidate qualification run 30487492458 built Linux successfully inside the pinned glibc container. That container reported 1,130 sccache requests and stopped its own server. The later host finalizer then tried to stop a host server that never compiled anything and failed with connection refused.

The regression came from removing the Linux host qualification-driver build while broadening the host finalizer to every successful Linux container build.

Base: 07451c4842ea8e9a635bf3940a25c1177db557aa
Head: 7291b522a0366b938c5ad78bcb268630418f7789
Tree: 50065b657546b76e9f8a01b32ad0d3a36654e895

What changed

• Linux keeps strict sccache statistics and shutdown inside the Docker process that owns its compiler server.
• The host finalizer now runs only after the non-Linux host package build.
• The workflow captures the pinned sccache binary's absolute path and SHA-256 immediately after installation, verifies that identity before Linux and host finalization, and invokes the captured binary rather than resolving through PATH.
• Build, clock-stop, and finalizer ordering is pinned. The reviewed workflow structure and quoted shell programs use exact digests so dead-code copies, quote escapes, fake paths, and advisory stops cannot satisfy policy.
• Workflow-policy mutations cover the reported regression and the adjacent executable bypasses.

The package matrix, job DAG, evidence cells, and release claim graph do not change, so release-claims.json remains unchanged.

Verification

• Independent executable review accepted patch digest a0fe8005daf3bb5e593f2637d2d2f245cd787e311fae6a24b962b511d2960c4f.
• The reviewer executed 26 hostile mutations covering fake PATH/GITHUB_ENV/NODE_OPTIONS, forged outputs, binary replacement, selector widening, absorbing shells, quote escapes, duplicate decoys, moved steps, disabled hash checks, and PATH invocation; all were rejected.
• Workflow policy: 1,001/1,001 tests; validator passed.
• Release claim graph: 38/38; digest 960e7071ba1e97425a9c0be13dc107dd35374bd8e9a6ed49fc522d1aa85062ac.
• actionlint wrapper and controlled-invalid fixture passed.
• The real local identity-capture script emitted the installed sccache path and SHA-256; the host finalizer rejected a deliberately wrong digest with exit 1.
• git diff --check passed.
• Exact-head source proof 30490798391 passed on 7291b522a0366b938c5ad78bcb268630418f7789.
  • Retrieval generalization: 47s.
  • Full source gate: 18m52s.
  • Compile: 15m04s; clippy: 1m07s; test step: 2m10s.
  • Workspace tests: 2,357/2,357 passed, 29 skipped, in 125.415s.

Release sequence

After merge, integrate this repair into #1597, restore the complete unfrozen pre-calibration constant set, recalibrate on that new exact head, freeze only the generated constant set, and run frozen-candidate qualification once. The previous calibration receipt is invalidated and will not be reused.

Refs #1597

Closes #1605