buildah

Ephemeral one-job runners start clean every time, so the usual on-disk caches are gone before the next job sees them. Two example workflows that fix that: a build/test job that caches the compiler over HTTPS, and an image build that caches layers in a registry - all with no Docker daemon.