ci(abi-drift): SHA-pin iseriser, drop sticky restore-keys (#111) (#172)

## Summary

- Pin iseriser to `741a3b63e7619b6e9cfe7f91b04d7ccfb130b1ca` (current
`main` HEAD, post-#20/#21/#22) instead of floating `--branch main`.
- Drop the prefix-matching `restore-keys` and key the cache by the rev
SHA so a future bump actually invalidates it.
- Always re-install with `--force`; the existence-check short-circuit
was the proximate cause of cached pre-#20 binaries surviving the fix
landing 11 days ago.

## Why

[iseriser#20](hyperpolymath/iseriser#20) (merged
2026-05-20) added GADT-skip to `abi-emit-manifest` so `data … where`
declarations (like vordr-mcp's `MonotonicDegradation` proof relation) no
longer crash with `Error: data declaration has no \`=\``. But this
repo's CI never picked up the new binary:

```yaml
# Before
key: iseriser-${{ runner.os }}-${{ github.sha }}
restore-keys: |
  iseriser-${{ runner.os }}-
```

`restore-keys` prefix-matches across every commit, so once any cache
existed for ubuntu it'd restore that one. Combined with:

```bash
if ! command -v iseriser >/dev/null 2>&1; then
  cargo install --git … --branch main --locked
fi
```

the install only fired if no binary existed at all. Result: stale binary
forever. Latest main run on 2026-05-26 (`gh run view 26426084041`) still
printed `Error: data declaration has no \`=\`` against vordr-mcp.

## Test plan

- [ ] CI runs `ABI Drift Gate` against this PR.
- [ ] `iseriser --version` log shows the post-#20 build.
- [ ] vordr-mcp line in the per-cartridge output reads ` ✓ vordr-mcp`
rather than ` ✗ vordr-mcp EMIT FAILED`.
- [ ] No regression in any other allowlisted cartridge.

Closes #111
Refs hyperpolymath/standards#92, hyperpolymath/iseriser#20.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/abi-drift.yml

@@ -54,24 +54,32 @@ jobs:
         with:
           toolchain: stable
 
+      # Pin to a specific iseriser commit so the cache key changes when
+      # we bump it. Floating `--branch main` + a prefix-matching
+      # `restore-keys` (`iseriser-${{ runner.os }}-`) was sticky: once a
+      # binary was cached for a given OS, the install step's
+      # `command -v iseriser` short-circuit skipped re-build, and #111's
+      # GADT-skip fix (iseriser#20, merged 2026-05-20) never reached CI.
+      # Bumping ISERISER_REV invalidates the cache and forces a rebuild.
       - name: Cache cargo bin (iseriser install)
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+        env:
+          ISERISER_REV: 741a3b63e7619b6e9cfe7f91b04d7ccfb130b1ca
         with:
           path: |
             ~/.cargo/bin/iseriser
             ~/.cargo/registry
             ~/.cargo/git
-          key: iseriser-${{ runner.os }}-${{ github.sha }}
-          restore-keys: |
-            iseriser-${{ runner.os }}-
+          key: iseriser-${{ runner.os }}-${{ env.ISERISER_REV }}
 
       - name: Install iseriser
+        env:
+          ISERISER_REV: 741a3b63e7619b6e9cfe7f91b04d7ccfb130b1ca
         run: |
           set -euo pipefail
-          if ! command -v iseriser >/dev/null 2>&1; then
-            cargo install --git https://github.com/hyperpolymath/iseriser --branch main --locked
-          fi
-          iseriser --version || true
+          cargo install --git https://github.com/hyperpolymath/iseriser \
+            --rev "$ISERISER_REV" --locked --force
+          iseriser --version
 
       - name: Resolve cartridge allowlist
         id: discover