ci: cache the assembled scss tree

Move the cacher bootstrap to the first task and assemble the shared
sourcehut scss partials in ~/scss behind a cache keyed by
CORE_VER+BOOTSTRAP_REV. On a hit the build no longer talks to git.sr.ht
or github.com at all, so their outages can't fail it; a pin bump misses
and reassembles from source as before.

ci: cache Go module and build dirs via cacher

Same scheme as sr-ht-dolt (dbd8638 there): restore ~/go/pkg/mod and
~/.cache/go-build from the Garage docker-cache bucket before abuild and
seed them back after, keyed by go.sum via cacher (go.bigb.es/cacher).
GOCACHE/GOMODCACHE are re-pinned inside build() because abuild redirects
them into its throwaway $tmpdir and an upstream typo in abuild.in
clobbers any pre-set GOMODCACHE with GOCACHE's value.

ci(apk): build CSS against core 0.84.5

Tracks the srht deployment's SRHT_CORE_VER bump (unified project nav
added scss/nav.scss and reworked dark.scss). BOOTSTRAP_REV unchanged —
the bootstrap submodule did not move between 0.83.8 and 0.84.5.

build: package spec.sr.ht as an apk and wire push->build->mirror

Deploy the service from our own apk repo instead of cloning and
compiling this tree inside the srht stack's Dockerfile.

- APKBUILD: build css then static binaries (CGO_ENABLED=0), install
  under ASSETS=/usr/share/sourcehut so specsrht-migrate resolves schema
  and migrations at the real runtime path. pkgver rewritten by CI to
  0.0.<commit-count> for a monotonic, pinnable version.
- .build.yml: builds.sr.ht manifest — assemble the shared sourcehut
  scss partials (core.sr.ht CORE_VER + pinned Bootstrap submodule),
  throwaway per-build signing key, abuild, publish *.apk to the Garage
  repo bucket (append-only; apk-mirror on phoebe re-indexes and signs).
- .sourcecraft/webhooks.yaml: push webhook to the phoebe gitsync
  service so the git.srht.bigb.es mirror updates in seconds, which is
  what makes the push -> apk build fire immediately.