docs: cache immutable archive builds

[jeremi]

Stacked on the fail-closed controls PR. Implements the content-addressed documentation archive cache recommended in #427.

• uses incremental archive mode for pull requests and full rebuilds on main, schedules, and explicit full dispatches
• keys each archive by pinned source refs, archive-affecting inputs, Node and lockfile inputs, and digests of allowlisted build settings
• restores only exact, validated cached outputs
• rejects path traversal, symlink traversal, stale metadata, and altered output digests
• includes restored archive indexes in the combined link check
• keeps the cache free of credentials and raw environment values

Verification:

• 134 docs script tests
• full historical docs check
• 175-page production build
• workflow lint and gate inventory checks

Part of #427.

[jeremi]

Release review verdict: please fix and rebase before merge.

Required changes:

• Decide and enforce the production Pages policy. Pushes to main currently use incremental archive mode and can publish restored archives, while the intended main-path contract is a full rebuild. Make main pushes full, or explicitly document and gate a different policy.
• Rebase the stack after the release reproducibility work lands and preserve current release and gate-inventory behavior.
• Run the full docs, release-tooling, workflow, and protected-branch checks. Only DCO has run for this PR head.

This cache work is not a beta-16 blocker, so it should wait until after the release.

[jeremi]

Fresh beta-16 review at head 888008b09dab8bdf84a3daf40585159b47cec067: please keep this stacked draft out of the current release train.

Required before reconsideration:

• rebase the stack after release: add fail-closed finalization controls #431 is corrected and after fix(notary): avoid standalone test TCP exhaustion #443 lands, preserving fix(release): make release builds reproducible #440 and security: retire stale dependency exceptions #434
• resolve the current release workflow/tooling conflicts
• make production Pages pushes rebuild the full immutable archive set, or explicitly document and approve a different policy with its release-evidence implications
• rerun the full protected-branch checks on the final rebased merge result

The caching direction is useful, but production push currently selects incremental archive mode and the current head has only DCO evidence.