* ci: narrow native, launcher and packaging cache keys and stop PR-local saves
* ci: hash Rust crate sources, not build outputs, in launcher and hook keys
* ci: fail closed on unlocked native packages and cover transitive key inputs
* ci: resolve the Windows Rust cache scope with a script, not a nested local action
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
