ci: run the suites against a real Postgres on the builder

93 test files across 16 packages had never run on builds.sr.ht. The manifest
brings up a Postgres in the VM, exports SPECSRHT_TEST_PG and runs gofmt, go vet
and `make test` before abuild.

The DSN guard is the point of it. db/db_test.go, service/fixture_test.go and
cmd/specsrht-migrate/main_test.go all gate on that variable, so an unset DSN
does not fail anything — it skips 67 tests (counted, with and against a local
Postgres) and leaves the build green over the whole persistence layer, the
schema/migrations agreement check included. options="!check" in the APKBUILD
means this task is the only place the suites run at all, so the guard is what
makes that line true.

TEST_TIMEOUT lands with it rather than after the first goroutine dump: the
toolchain's default is a silent ten minutes.

ci: export the version instead of sed-ing a tracked APKBUILD

The version reaches abuild as $PKGVER now, and the tracked APKBUILD is never
rewritten: Go reads vcs.modified from `git status --porcelain`, so a sed of a
tracked file stamps every packaged binary dirty for the whole abuild run.

The export alone would not have fixed it. .gitignore covered the intermediate
web/static/main.css and not the content-hashed main.min.<sha>.css that `make
css` renames it to — the file that survives, and that build() writes BEFORE go
build — so every packaging run compiled with an untracked file in the tree.
/src/, /pkg/ and /tmp/ are the three directories abuild works in inside this
checkout, GOTMPDIR among them.

Also: the cacher bootstrap splits into install + init so the installer's PATH
export is sourced by the next task, and goes through install.sh for its
checksum verification; scss collapses into the --exec miss-and-seed form;
cache_restore takes --optional plus the half-restored module cache repair;
cache_save moves after publish and drops the exists-guards; publish gates on a
readable ~/.apk-ci.env; tags build.

package() stages what build() produced (make install-files) instead of
recompiling both binaries in a fresh fakeroot process with no cache pins, and
stops installing static assets that //go:embed already put in the binary. The
`[ -d ./cmd/... ]` skip guards are gone: a deleted cmd/ was a green build that
packaged nothing.

The reasoning lives in docs/ci.md, because the manifest is a varchar(16384)
and a submission over the cap gets no CI at all.

fix(apk): keep -modcacherw when overriding GOFLAGS

The GOFLAGS="-trimpath" passed to make clobbers abuild's default
GOFLAGS, dropping -modcacherw: the module cache then extracts read-only
and the CI cache tarball made from it fails to unpack on the next build
(mkdir into 0555 dirs, permission denied — warm build #267). The
poisoned gomod tarball was deleted by ad-hoc job #268.

ci: cache Go module and build dirs via cacher

Same scheme as sr-ht-dolt (dbd8638 there): restore ~/go/pkg/mod and
~/.cache/go-build from the Garage docker-cache bucket before abuild and
seed them back after, keyed by go.sum via cacher (go.bigb.es/cacher).
GOCACHE/GOMODCACHE are re-pinned inside build() because abuild redirects
them into its throwaway $tmpdir and an upstream typo in abuild.in
clobbers any pre-set GOMODCACHE with GOCACHE's value.

build: package spec.sr.ht as an apk and wire push->build->mirror

Deploy the service from our own apk repo instead of cloning and
compiling this tree inside the srht stack's Dockerfile.

- APKBUILD: build css then static binaries (CGO_ENABLED=0), install
  under ASSETS=/usr/share/sourcehut so specsrht-migrate resolves schema
  and migrations at the real runtime path. pkgver rewritten by CI to
  0.0.<commit-count> for a monotonic, pinnable version.
- .build.yml: builds.sr.ht manifest — assemble the shared sourcehut
  scss partials (core.sr.ht CORE_VER + pinned Bootstrap submodule),
  throwaway per-build signing key, abuild, publish *.apk to the Garage
  repo bucket (append-only; apk-mirror on phoebe re-indexes and signs).
- .sourcecraft/webhooks.yaml: push webhook to the phoebe gitsync
  service so the git.srht.bigb.es mirror updates in seconds, which is
  what makes the push -> apk build fire immediately.