workflows: add actions/cache for Go modules + apt packages

Pay ~10s per job to install Node so actions/cache@v4 works, then
restore Go module cache (~/go/pkg/mod + ~/.cache/go-build) and apt
package cache (/var/cache/apt/archives + /var/lib/apt/lists).

Expected impact:
- Cold run (first push after this commit): same as before, plus ~10s
  Node install. Cache populates.
- Warm runs: Go modules instant instead of ~15s download, apt install
  ~10s instead of ~60s. Net save ~60s per run.

Cache keys:
- Go: go-${runner.os}-${hashFiles('**/go.sum')} — invalidates on any
  go.sum change.
- Apt: apt-trixie-wine-innoextract-v1 — bump version (-v2, -v3) when
  the package list in 'Install Wine + Inno Setup' step changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -17,25 +17,36 @@ concurrency:
   group: build-${{ github.ref }}
   cancel-in-progress: true
 
-# We deliberately avoid actions/cache@v4 and actions/upload-artifact@v4 in this
-# workflow. They are Node.js-based and the runner image (golang:*) has no Node.
-# Installing Node would add ~10s per job for every run; for now we accept
-# that go module downloads happen on each invocation (~20-30s once warm).
-# Real release artifacts are produced by release.yml via curl + Forgejo API.
+# Node.js is installed at the start of every job so actions/cache@v4
+# (which uses Node) can run. Installing Node costs ~10s; the resulting
+# Go module + apt cache restore typically saves 30-60s on warm runs.
 
 jobs:
   test:
     runs-on: go
     steps:
+      - name: Install Node (required by actions/cache)
+        run: |
+          apt-get update >/dev/null
+          apt-get install -y --no-install-recommends nodejs >/dev/null
+
       - name: Checkout
         env:
-          # Gitea Actions doesn't auto-export GITHUB_TOKEN to the shell;
-          # we have to read it from secrets and surface it explicitly.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git clone --no-checkout "https://x-access-token:${GITHUB_TOKEN}@git.okcu.io/${GITHUB_REPOSITORY}.git" /tmp/src
           git -C /tmp/src checkout "$GITHUB_SHA"
           cp -a /tmp/src/. .
+
+      - name: Cache Go modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
+          restore-keys: go-${{ runner.os }}-
+
       - name: Vet
         run: go vet ./...
       - name: Test with race
@@ -50,15 +61,28 @@ jobs:
     runs-on: go
     needs: test
     steps:
+      - name: Install Node (required by actions/cache)
+        run: |
+          apt-get update >/dev/null
+          apt-get install -y --no-install-recommends nodejs >/dev/null
+
       - name: Checkout
         env:
-          # Gitea Actions doesn't auto-export GITHUB_TOKEN to the shell;
-          # we have to read it from secrets and surface it explicitly.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git clone --no-checkout "https://x-access-token:${GITHUB_TOKEN}@git.okcu.io/${GITHUB_REPOSITORY}.git" /tmp/src
           git -C /tmp/src checkout "$GITHUB_SHA"
           cp -a /tmp/src/. .
+
+      - name: Cache Go modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
+          restore-keys: go-${{ runner.os }}-
+
       - name: Cross-compile drover.exe (windows/amd64)
         env:
           GOOS: windows

.gitea/workflows/release.yml

@@ -16,6 +16,11 @@ jobs:
   release:
     runs-on: go
     steps:
+      - name: Install Node (required by actions/cache)
+        run: |
+          apt-get update >/dev/null
+          apt-get install -y --no-install-recommends nodejs >/dev/null
+
       - name: Checkout
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -24,6 +29,26 @@ jobs:
           git -C /tmp/src checkout "$GITHUB_SHA"
           cp -a /tmp/src/. .
 
+      # Cache Go modules — saves ~10-20s on warm runs.
+      - name: Cache Go modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
+          restore-keys: go-${{ runner.os }}-
+
+      # Cache apt downloads — saves ~50s on the wine + innoextract install.
+      # Bump the cache key (-v2, -v3, ...) when the package list changes.
+      - name: Cache apt packages
+        uses: actions/cache@v4
+        with:
+          path: |
+            /var/cache/apt/archives
+            /var/lib/apt/lists
+          key: apt-trixie-wine-innoextract-v1
+
       - name: Extract version from tag
         id: version
         run: |