ci(e2e): key the Rust cache on the CPU model (fixes SIGILL in the desktop-shell tests) (#158)

## Summary

`Rust Backend — Build + Check` (e2e.yml) can fail with `SIGILL: illegal
instruction` in the `panll-gossamer` test harness when a Rust cache
saved on one runner CPU is restored on another. This PR adds the CPU
model to that job's rust-cache key.

## Root cause

- gossamer-rs's `build.rs` compiles libgossamer with `zig build-lib
src/main.zig -static -OReleaseSafe -fcompiler-rt` and passes **no
`-target` or `-mcpu`**, so Zig targets the build host's CPU.
- The archive bundles Zig's `compiler_rt`, which exports
`memcpy`/`memset`. Every binary that links libgossamer runs that code,
even the bin's test harness, which has no tests.
- `e2e.yml` caches `target/`, which holds that archive, and the key
doesn't include the CPU. `ubuntu-latest` mixes CPU models, so a cached
archive can contain instructions the next runner's CPU lacks.

## Evidence (#155)

| Run | Head | Rust cache | Result |
|---|---|---|---|
| 114 | `36075ad` | miss (0 s); built everything (60 s); **saved** the
cache | ✅ |
| 116 | `ef97696`, with Rust source byte-identical to `36075ad` |
**restored**, full match on
`v0-rust-gossamer-backend-Linux-x64-01b81e85-97fe8c31`; rebuilt only
`panll` (22 s) | ❌ SIGILL in `panll_gossamer-…` at startup |

## Change

A new step hashes the CPU model name from `/proc/cpuinfo` (`sha256sum |
cut -c1-12`) and passes it to `Swatinem/rust-cache` as `key:
cpu-<hash>`. Both the exact match and the fallback restore keys include
it, so `target/` is only reused on the same CPU model. The cost is more
cache misses when the job lands on a new CPU model. The step uses no new
action, so `actions.lock` is unchanged by this commit.

The durable fix is upstream: gossamer-rs's `build.rs` should pass a
portable `-mcpu`, such as `baseline` or `x86_64_v3`. I haven't made that
change, because it belongs to `metadatastician/gossamer`.

This branch also carries #156's two lockfile commits,
cherry-picked unchanged, so its governance, scan and Hypatia checks can
pass before #156 merges.

## Verification

- `e2e.yml` parses, and the step order is checkout → toolchain → **CPU
model** → rust-cache → GTK → Zig → build → test.
- The step's command produces a stable key locally
(`model=d7a559f48243`).
- Editing `e2e.yml` triggers the e2e job on this PR, which tests the
change against a real runner.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01SJtjqoZaSQo7uBwvwVMA9G)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/e2e.yml

@@ -54,8 +54,17 @@ jobs:
         with:
           toolchain: stable
 
+      # gossamer-rs builds libgossamer with Zig for the host CPU (no -mcpu), so
+      # a target/ cache restored on a runner with another CPU model can die
+      # with SIGILL. Key the cache on the CPU model.
+      - name: CPU model for the cache key
+        id: cpu
+        run: echo "model=$(grep -m1 'model name' /proc/cpuinfo | sha256sum | cut -c1-12)" >> "$GITHUB_OUTPUT"
+
       - name: Rust cache
         uses: Swatinem/rust-cache@v2.9.2
+        with:
+          key: cpu-${{ steps.cpu.outputs.model }}
 
       - name: Install GTK/WebKit dev headers
         run: sudo apt-get update && sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev