ci: conformance suite with Garage S3 image cache (7lf)

Two new srht.bigb.es manifests:

  .builds/conformance.yml — auto-submits on push to master/tags. Pulls
  the conformance Docker image from s3://docker-cache/ keyed by
  sha256(docker/conformance.Dockerfile); on cache miss, builds it and
  uploads. Runs both 'just conformance' and the C-runtime variant
  against the cached image.

  .builds/conformance-image-rebuild.yml — manual-submit only
  (allow-refs: []). Force-rebuilds with --no-cache --pull and replaces
  the S3 object. Use when the cached image needs refresh without a
  Dockerfile change (base-image CVE, host docker upgrade, corrupted
  upload).

Garage S3 specifics:
  - addressing_style = path (Garage doesn't do virtual-host)
  - signature_version = s3v4 (Garage rejects SigV2)
  - region = garage (matches phoebe-lab/garage/config/garage.toml.tmpl)
  - head-object for cache-hit check (s3 ls returns exit 0 on missing
    keys; head-object 404s cleanly)
  - Endpoint https://s3.bigb.es works from the build worker because
    srht-build-1 (192.168.88.128) is in Authelia's *.bigb.es LAN-bypass
    range (192.168.88.0/24)

Credentials come from two file secrets registered at
https://builds.srht.bigb.es/secrets, mounted as ~/.s3-cache-key-id and
~/.s3-cache-key-secret. Loaded under 'set +x' and persisted to
~/.buildenv via printf %q so subsequent tasks pick them up without
re-tracing.

The bucket 'docker-cache' and its bound key must exist on Garage with
read+write permission for the supplied access key — first push will
fail at the smoke-test 'aws s3 ls' line otherwise. (7lf)

ci: install Go 1.26 toolchain + cmake on builds.srht

Ubuntu noble's `golang` apt package is too old to satisfy go.mod's
toolchain directive — `go build` aborted with "toolchain not available".
Drop the apt package, install the official Go 1.26.3 tarball into
~/.local/go, and update go.mod / bench/go/go.mod accordingly. Also add
cmake + build-essential so `tt rocks install luatest` can build its
`checks` dependency.

c-accel: arch prereqs — compat contract, C-side strategy, build scaffolding

Three companion specs under docs/specs/ formalize the boundaries
established in docs/c-accel.md, unblocking bd-mq7 (descriptor → C
plan compiler):

* c_accel_compat.md (bd-47e) — pinpoints what must stay byte-equal
  between PB_ENABLE_C unset and =1: public surface, generated
  module wrappers, 64-bit cdata, WKT shapes, unknown fields,
  extensions, errors. Calls out the lazy-view exclusion.

* c_accel_strategy.md (bd-z7x) — pb_plan struct layout, field-name
  luaL_ref caching, 4 KB stack-backed pb_buf, cached per-field
  stack indices (the 2× win from spike Phase B), sub-buffer over
  backpatching, map/oneof/unknown handling.

* c_accel_build_packaging.md (bd-wky) — where the C module lives
  (runtime/pb/c/), how it builds, what the rockspec gains, the CI
  matrix shape.

Scaffolding that lands now:

* runtime/pb/init.lua — PB_ENABLE_C=1 opt-in pcall hook; the
  loaded module (or nil) is exposed as pb.c_runtime for
  introspection. Silent fallback when the module is absent.

* Justfile — `build-c` / `clean-c` recipes (stub erroring cleanly
  until bd-ra6 lands runtime/pb/c/), new lua_cpath constant,
  LUA_CPATH wired through `test` and `test-one`.

* .builds/{pure-lua,c-enabled}.yml — sourcehut CI manifests, one
  per activation mode (sourcehut has no matrix; parallel jobs go
  in separate files). ubuntu/noble images.

* .sourcehut/conformance.yml — outside .builds/ so it doesn't
  auto-submit; trigger manually with `hut builds submit` before
  releases.

* .gitignore — runtime/pb/c_runtime.{so,dylib} and runtime/pb/c/*.o.

745/745 tests pass with PB_ENABLE_C unset and PB_ENABLE_C=1
(silent fallback verified).

Closes bd-47e, bd-z7x, bd-wky. Unblocks bd-mq7.