Wire runner caches and forge secrets through agenix

.forgejo/workflows/build-rust.yml

@@ -17,6 +17,10 @@ jobs:
   rust:
     name: Cargo Test
     runs-on: [self-hosted, linux, x86_64, burrow-forge]
+    env:
+      CARGO_INCREMENTAL: 0
+      RUSTC_WRAPPER: sccache
+      SCCACHE_CACHE_SIZE: 20G
     steps:
       - name: Checkout
         uses: https://code.forgejo.org/actions/checkout@v4
@@ -24,8 +28,21 @@ jobs:
           token: ${{ github.token }}
           fetch-depth: 0
 
+      - name: Prepare Cache Dirs
+        shell: bash
+        run: |
+          set -euo pipefail
+          cache_root="${HOME}/.cache/burrow"
+          mkdir -p "${cache_root}/cargo" "${cache_root}/sccache"
+          echo "CARGO_HOME=${cache_root}/cargo" >> "${GITHUB_ENV}"
+          echo "SCCACHE_DIR=${cache_root}/sccache" >> "${GITHUB_ENV}"
+
       - name: Test
         shell: bash
         run: |
           set -euo pipefail
-          nix develop .#ci -c cargo test --workspace --all-features
+          nix develop .#ci -c bash -lc '
+            sccache --zero-stats >/dev/null 2>&1 || true
+            cargo test --workspace --all-features
+            sccache --show-stats || true
+          '