feat(sfw): cache the sfw binary via @actions/cache

Saves ~130 MB and ~5-15s per run, and gives us a fallback when the
GitHub releases CDN flakes (we've hit that class of incident before
for the vp install scripts in #67).

Implementation:
- restoreCache at the start of installSfw with key
    sfw-${SFW_VERSION}-${platform}-${arch}-${libc}
  No restoreKeys: we never accept a different version's binary as a
  fallback. The version is in the key so a Renovate bump to
  SFW_VERSION naturally evicts stale entries (GHA also auto-evicts
  after 7 days).
- On cache hit: chmod+addPath and return — skip the download entirely.
- On cache miss: existing download/retry path runs, then saveCache
  publishes to GHA cache for future runs.
- All cache calls wrapped in try/catch so any cache-service failure
  (network blip, 5xx, ReserveCacheError on duplicate key) falls
  through cleanly to the download path; cache is never load-bearing.
- The composition path (socketdev/action@<sha>) is untouched —
  findSfwOnPath() still wins and we don't double-cache what
  @actions/tool-cache (which socketdev/action uses) already manages.

CI: existing test-sfw matrix exercises both the cache-miss (first
push on a branch) and cache-hit (subsequent pushes) paths; no new
job needed.

Author: fengmk2

dist/index.mjs

@@ -1,3 +1,4 @@
+import { restoreCache, saveCache } from "@actions/cache";
 import { info, warning, addPath } from "@actions/core";
 import { exec } from "@actions/exec";
 import { execFileSync } from "node:child_process";
@@ -86,6 +87,30 @@ export async function installSfw(): Promise<void> {
   mkdirSync(binDir, { recursive: true });
   const binPath = join(binDir, process.platform === "win32" ? "sfw.exe" : "sfw");
 
+  // Try the GHA cache first so we don't redownload ~130 MB on every run and
+  // we get a fallback when the GitHub releases CDN flakes. Key includes the
+  // pinned version + platform + arch + libc; no restoreKeys, so we never
+  // accept a different version's binary as a fallback. All cache calls are
+  // best-effort: any failure falls through to the download path.
+  const cacheKey = `sfw-${SFW_VERSION}-${process.platform}-${process.arch}-${isMuslLinux() ? "musl" : "glibc"}`;
+  let cacheHit = false;
+  try {
+    const matchedKey = await restoreCache([binDir], cacheKey);
+    if (matchedKey && existsSync(binPath)) {
+      if (process.platform !== "win32") {
+        chmodSync(binPath, 0o755);
+      }
+      addPath(binDir);
+      info(`sfw restored from cache: ${matchedKey}`);
+      cacheHit = true;
+      return;
+    }
+  } catch (error) {
+    warning(
+      `sfw cache restore failed (${error instanceof Error ? error.message : String(error)}); falling through to download.`,
+    );
+  }
+
   info(`Installing sfw from ${url}...`);
 
   const maxAttempts = INSTALL_MAX_ROUNDS;
@@ -99,6 +124,19 @@ export async function installSfw(): Promise<void> {
         }
         addPath(binDir);
         info(`sfw installed at ${binPath}`);
+        // Save to cache for future runs. Skipped on cache-hit branch (return
+        // above). On a re-key collision @actions/cache throws
+        // ReserveCacheError — swallow it like any other cache failure.
+        if (!cacheHit) {
+          try {
+            await saveCache([binDir], cacheKey);
+            info(`sfw cached under key: ${cacheKey}`);
+          } catch (error) {
+            warning(
+              `sfw cache save failed (${error instanceof Error ? error.message : String(error)}); continuing.`,
+            );
+          }
+        }
         return;
       }
       failureReason = `exit code ${exitCode}`;