[supermomonga]

Problem

The repository used 4.3 GB of Actions cache (63 entries) and 960 MB of artifacts.

• Every setup-node job with cache: npm saved a 65 MB npm cache per OS, per lockfile hash and per ref. Caches saved on refs/pull/N/merge, release/v* and tags cannot be read from main or other pull requests, so about 3 GB of the 4.3 GB was never reused. A version bump changes package-lock.json, so every release also created a new cache for all five OSes.
• The zcode-runtime archive artifact (79 MB) was kept for the default 90 days, although only the same run uses it.

Changes

• Add .github/actions/setup-node-deps, which sets up Node.js, restores the npm cache, runs npm ci --include=dev and saves the cache only on main when the key missed. Other refs restore it and fall back to an older main cache through restore-keys. main saves only exact keys, so its cache does not keep tarballs of replaced dependencies.
• Use the action in every job that used cache: npm: CI (test, runtime matrix, E2E), both release checks and the ZCode runtime verification matrix. In the verification matrix, dependencies are now installed before the archive is extracted.
• Keep the zcode-runtime artifact for one day. Tags still publish the archive as a release asset.
• Run the ZCode runtime workflow on pull requests that change the action, and include .github/actions in format / format:check.
• Document the cache policy in docs/development.md.

Expected steady state is one npm cache per OS on main (about 330 MB). The existing node-cache-* entries on main stop being used after this merges and expire after seven days without access.

Repository changes already applied

These are not part of the diff:

• Artifact and log retention is now 14 days instead of 90.
• All 12 existing artifacts and the 43 caches on refs other than main were deleted. Cache usage is now 1.3 GB (20 entries on main).

Verification

• actionlint and npm run format:check pass locally.
• This pull request runs CI and the ZCode runtime workflow on all five platforms. Pull request runs should restore the cache and not save it.