fix(ci): isolate legacy Cargo scratch from workflow PVC

[usr-bin-roygbiv]

Summary

This is a focused shared-service blocker fix. It moves only the legacy OMP Cargo target out of Woodpecker's 6 Gi shared workflow PVC and onto container /tmp, which is governed by the existing 12 Gi pod ephemeral-storage limit. It disables Cargo incremental output while the unchanged upstream build copies its final napi artifact into .continuity/omp/packages/natives/native for the subsequent legacy-bridge-continuity step.

Failure evidence

• Woodpecker pipelines p100 and p103 on k3s-worker-01 both exited code 1 when rust-lld received SIGBUS.
• Neither pod was OOM-killed; memory peaked near 2.3 GiB of the 6 GiB limit, runtime was far below 60 minutes, and the node had no pressure.
• Their independent 6 GiB workflow scratch PVCs reached 5.52/5.54 GB, leaving only 257–283 MB free at link time.

Change

• Set CARGO_TARGET_DIR=/tmp/t4-legacy-authority-target on legacy-authority-build.
• Set quoted CARGO_INCREMENTAL="0".
• Retain the existing 12 Gi ephemeral-storage limit, pinned tools/resources/dependencies, build commands, bridge dependency, and .continuity/omp artifact path.
• Add an observable cluster CI contract for those invariants.

Remote-CI TDD proof

• Test-only commit: f2d500c27e08bc0887e999c7d73ec8a6bb5d0cbf
• Expected red: GitHub run 29886104070, cluster job 88816891502. The contract observed CARGO_TARGET_DIR as undefined instead of /tmp/t4-legacy-authority-target.
• Final commit: 8cd1d28ae4abd86a7d730490cbb6e6a91bc6c284
• Full terminal green: GitHub run 29886381494: changes 88817678992, core 88817679027, cluster 88817706007, tooling 88817706009, and terminal verify 88818469675 all succeeded. Path-unselected platform/legacy jobs were skipped by the existing classifier.

Non-goals

• No Woodpecker trigger, retry, cancellation, or cluster mutation.
• No image, pinned toolchain, resource, dependency, source revision, build command, or product-code change.
• No change to the shared workflow PVC itself.

Relation to #125

PR #125 already supplied the Rust/Bun toolchain and resource-limit work now present on main. This PR does not copy its remaining lower-resource delta; it adds only the isolated Cargo scratch contract/configuration required by the subsequently diagnosed PVC exhaustion.

Rollback

Revert 8cd1d28ae4abd86a7d730490cbb6e6a91bc6c284 to return Cargo intermediates to the workflow workspace, then revert the test-only contract commit with it.

[wolfiesch]

Reviewed exact head 8cd1d28. The change is narrowly scoped to Cargo scratch placement, preserves the final native artifact in the shared continuity workspace, and has coherent red/green contract evidence with terminal selected CI. No blocking issue found.