ci: cache pinned just release in Garage S3 (just/ prefix)

just.systems/install.sh downloads the just binary from
github.com/casey/just/releases/, which 502'd on #136. Same pattern as
go: pin JUST_VERSION=1.51.0, cache the release tarball, fall back to
GitHub on cache miss with --retry 3 --max-time 60. As a bonus the
version is now pinned (was floating-latest before).

S3 key: s3://docker-cache/just/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz

Pre-seeded the 1.51.0 tarball into S3 manually so the first run hits
cache immediately.

ci: cache Go tarball in Garage S3 (golang/ prefix)

go.dev/dl sometimes times out on the build VM. Cache Go in S3 keyed
by version: s3://docker-cache/golang/go${GO_VERSION}.linux-amd64.tar.gz.

  - Cache HIT: pull from S3 (LAN, fast)
  - Cache MISS: curl from go.dev with --retry 3 --max-time 300, install,
    upload to S3 for next time

Applied to all three manifests. pure-lua.yml and c-enabled.yml now also
require S3 credentials, which slightly couples them to the same fate as
conformance.yml — acceptable tradeoff for the reliability gain since
the same flaky go.dev pull was the root cause.

ci: install Go 1.26 toolchain + cmake on builds.srht

Ubuntu noble's `golang` apt package is too old to satisfy go.mod's
toolchain directive — `go build` aborted with "toolchain not available".
Drop the apt package, install the official Go 1.26.3 tarball into
~/.local/go, and update go.mod / bench/go/go.mod accordingly. Also add
cmake + build-essential so `tt rocks install luatest` can build its
`checks` dependency.

c-accel: arch prereqs — compat contract, C-side strategy, build scaffolding

Three companion specs under docs/specs/ formalize the boundaries
established in docs/c-accel.md, unblocking bd-mq7 (descriptor → C
plan compiler):

* c_accel_compat.md (bd-47e) — pinpoints what must stay byte-equal
  between PB_ENABLE_C unset and =1: public surface, generated
  module wrappers, 64-bit cdata, WKT shapes, unknown fields,
  extensions, errors. Calls out the lazy-view exclusion.

* c_accel_strategy.md (bd-z7x) — pb_plan struct layout, field-name
  luaL_ref caching, 4 KB stack-backed pb_buf, cached per-field
  stack indices (the 2× win from spike Phase B), sub-buffer over
  backpatching, map/oneof/unknown handling.

* c_accel_build_packaging.md (bd-wky) — where the C module lives
  (runtime/pb/c/), how it builds, what the rockspec gains, the CI
  matrix shape.

Scaffolding that lands now:

* runtime/pb/init.lua — PB_ENABLE_C=1 opt-in pcall hook; the
  loaded module (or nil) is exposed as pb.c_runtime for
  introspection. Silent fallback when the module is absent.

* Justfile — `build-c` / `clean-c` recipes (stub erroring cleanly
  until bd-ra6 lands runtime/pb/c/), new lua_cpath constant,
  LUA_CPATH wired through `test` and `test-one`.

* .builds/{pure-lua,c-enabled}.yml — sourcehut CI manifests, one
  per activation mode (sourcehut has no matrix; parallel jobs go
  in separate files). ubuntu/noble images.

* .sourcehut/conformance.yml — outside .builds/ so it doesn't
  auto-submit; trigger manually with `hut builds submit` before
  releases.

* .gitignore — runtime/pb/c_runtime.{so,dylib} and runtime/pb/c/*.o.

745/745 tests pass with PB_ENABLE_C unset and PB_ENABLE_C=1
(silent fallback verified).

Closes bd-47e, bd-z7x, bd-wky. Unblocks bd-mq7.