ci: rewrite storage policy for Blacksmith sticky disks and colocated cache

[DecisionNerd]

Problem

scripts/ci/test-ci-storage-policy.py still encodes a GitHub Actions cache-era policy (ban maturin sccache because of GHA backend; forbid large trees in actions/cache). We run on Blacksmith, where sticky disks (~3s hydrate) and colocated cache are the right tools—and Binding RC does not mount sticky target/ today.

Objective

Rewrite CI storage policy around Blacksmith primitives so Binding RC and publish-track can use sticky disks and colocated cache honestly.

Parent

Blocks #383.

Requirements

Allowed	Purpose
useblacksmith/stickydisk for target/, optional .sccache, large build trees	Persist compile products across RC/publish-track runs
Upstream actions/cache@v6 for ~/.cargo/registry + git (and pnpm/uv)	Colocated Blacksmith cache; exact lockfile keys
Local sccache with SCCACHE_DIR on a sticky disk	Cross-crate compile cache without GHA-backend maturin sccache
Bigger Blacksmith runners for RC cells	Documented as allowed

Still forbidden	Why
Putting target/ into actions/cache blobs	Wrong tool — use sticky disks
Maturin-action sccache: true (GHA-integrated)	Prefer sticky SCCACHE_DIR / sticky target/
Unbounded artifact uploads	Keep consumer-driven retention for candidate partitions

Update scripts/ci/test-ci-storage-policy.py and .github/workflows/README.md with Blacksmith-first rules and expected sticky key patterns for Binding RC.

Acceptance Criteria

• Storage policy tests pass and encode the allowed/forbidden table above.
• README documents Blacksmith-first rules.
• No Binding RC speed work is required to close this issue if policy + docs land; wiring sticky mounts may land here or in the Binding RC sub-issue without overlap of concern (policy vs RC workflow). Prefer policy/tests/docs in this issue; RC workflow mounts in the Binding RC issue.

BDD Completion Scenarios

Policy allows sticky target

Given a workflow uses useblacksmith/stickydisk for target/ with a lockfile-keyed identity
When storage policy tests run
Then the pattern is allowed
And target/ inside actions/cache remains forbidden.

Maturin GHA sccache still banned

Given maturin-action sccache: true
When storage policy tests run
Then the pattern fails
And sticky SCCACHE_DIR is documented as the replacement.

Non-Goals

• Achieving Binding RC ≤20m (sibling issue).
• Changing publish.yaml honesty.

Testing

• python scripts/ci/test-ci-storage-policy.py (or repo-equivalent CI job) green.

[coderabbitai]

🔗 Related PRs

#206 - ci: move job transfers to Blacksmith storage [merged]
#208 - ci: minimize Blacksmith cache storage [merged]
#278 - fix(ci): retain certification evidence as artifacts [merged]
#316 - fix(release): retain Binding RC evidence without brace globs [merged]
#377 - test(release): isolate npm publication dry-run policy [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!