ci: cache pip and Ansible Galaxy dependencies

[randomparity]

Adds dependency caching to the CI workflows.

What this does

• cache: pip with cache-dependency-path: requirements-dev.txt on all three
  actions/setup-python steps (lint, pytest, molecule). All three jobs install
  from the same file, so one dependency path covers them.
• An actions/cache step for ~/.ansible/collections, keyed on a hash of
  requirements.yml, in the two jobs that run ansible-galaxy collection install (lint and molecule). The pip cache does not cover Galaxy collections.
  The pytest job does not install collections and does not get this step.

The new actions/cache ref is pinned to a full commit SHA (v6 →
55cc8345863c7cc4c66a329aec7e433d2d1c52a9) to satisfy the zizmor
unpinned-uses gate added in #124.

Notes

• The molecule job is a four-leg matrix. The cache key is deliberately not
  matrix-dependent — all four legs install the same requirements.yml and share
  one entry. Concurrent saves produce an actions/cache warning, not a failure.
• ansible-galaxy collection install runs unconditionally rather than being
  gated on cache-hit, so a partial or stale cache is reconciled against
  requirements.yml on every run. Verified locally that installing over a
  different pinned version overwrites correctly in both the upgrade and
  downgrade direction.
• cache: pip caches pip's download cache, not installed packages — pip install still resolves and installs each run, so the saving is download time
  only. Expect the first run on this branch to be a cache miss.

Closes #125

[randomparity]

WORK:REVIEW

• Verdict: approve (1 iteration, 0 blocking findings)
• Method: /challenge --base main, focused on cache correctness — stale-cache poisoning of pinned Galaxy versions, restore-keys safety, matrix key contention, PR/main cache scope, SHA pin + zizmor gate integrity, pip cache-dependency-path correctness.
• Empirically tested, not assumed: the headline risk (a restore-keys partial hit leaving a stale pinned collection version in place) was reproduced in a scratch collections dir and does not occur — ansible-galaxy collection install -r requirements.yml cleanly overwrote 2.2.1 → 2.2.2 and 2.2.2 → 2.2.1, exit 0 both directions.
• Accepted risk, not blocking: a collection removed from requirements.yml lingers in a cache restored via restore-keys (ansible-galaxy installs but never prunes). Inherent to any dependency cache with a fallback key; the issue AC explicitly asks for restore-keys; production does a clean install.
• Security review: zizmor --min-severity high → 0 findings, exit 0. zizmor --persona=regular → 0 findings (1 ignored, 10 suppressed), unchanged from main. No regression against the gate added in Pin GitHub Actions to commit SHAs and add zizmor to CI #124.
• Guardrails: make lint, .venv/bin/pytest (29 passed), prek run --all-files, actionlint — all exit 0.