ci(fp-stability): derive Verrou cache key from verrou.sh content (no hand-synced version)

The cache key hardcoded verrou-a58d434-valgrind-3.26.0, synced to the installer's pins only by a comment — if verrou.sh bumped but the key didn't, CI would restore the stale cached tree and silently never exercise the new version. Key off hashFiles('toolchain/bootstrap/verrou.sh') so any pin change (or edit) auto-busts the cache. Also dropped the version literals from the workflow's header comment; the pinned versions now live solely in verrou.sh.

Author: sbryngelson

.github/workflows/fp-stability.yml

@@ -24,8 +24,9 @@ name: FP Stability
 # On FAIL: verrou_dd_sym runs to identify the responsible function symbols.
 # Logs are uploaded as CI artifacts.
 #
-# Verrou (Valgrind 3.26.0 + edf-hpc/verrou@a58d434) is built once and cached.
-# Build takes ~20 min uncached; cached runs restore in ~30 s.
+# Verrou (the pinned Valgrind+Verrou pair; versions live in toolchain/bootstrap/verrou.sh)
+# is installed by fp-stability on first use and cached. The prebuilt download is seconds;
+# a cache miss with no prebuilt falls back to a ~20-min source build.
 
 on:
   push:
@@ -68,8 +69,10 @@ jobs:
         uses: actions/cache@v4
         with:
           path: ~/.local/verrou
-          # Keep these versions in sync with toolchain/bootstrap/verrou.sh (the installer).
-          key: verrou-a58d434-valgrind-3.26.0-${{ runner.os }}
+          # Key off the installer's content so any version bump (or other edit) in
+          # verrou.sh auto-busts the cache and forces a fresh install — no hand-synced
+          # version string to drift out of date.
+          key: verrou-${{ hashFiles('toolchain/bootstrap/verrou.sh') }}-${{ runner.os }}
 
       - name: Install system dependencies
         run: |