ci: unblock Idris 2 verification on every PR

The Idris 2 CI workflow on `main` has been red since 2026-03-29
(6+ weeks). Root causes:

  1. `actions/cache@0c45773…` (v4.0.2) is now deprecated by GitHub
     and auto-fails every job that pins it. Affects four workflows:
     idris2-ci.yml (build + docs), echidna-verify.yml (Verify Idris 2
     Proofs), publish-crates.yml (cargo cache).

  2. architecture-enforcement.yml's `verify-idris-build` job has only
     a `echo "Idris2 installation (manual review required)"`
     placeholder where the install step should be. `idris2 --build`
     then runs against an empty PATH and emits the misleading
     "❌ Idris2 build failed - proofs are broken" message.

This commit:

  - Bumps actions/cache from v4.0.2 (deprecated SHA
    0c45773b623bea8c8e75f6c82b208c3cf94ea4f9) to v4.3.0 (SHA
    0057852bfaa89a56745cba8c7296529d2fc39830) in all four workflows.
    casket-pages.yml was already on v4.3.0, so the whole repo is
    now consistent.

  - Replaces the verify-idris-build placeholder with a real build
    that uses the `snazzybucket/idris2:latest` container. This is
    the same container used locally to verify proven#9 before merge,
    so the CI signal will match the manual verification process and
    we don't pay a ~10-minute idris2 source bootstrap per job.

Out of scope (left for follow-up):
  - hypatia-scan job assumes `../hypatia/elixir-scanner` exists in
    the runner workspace, which it doesn't — a sibling-repo clone
    step is needed. Tracked separately.
  - enforce-idris-only flags ~80 pre-existing `bindings/rust/src/
    safe_*.rs` files. The workflow's SOLUTION text says delete them
    but this needs a human-in-the-loop policy call. Tracked
    separately.

Author: hyperpolymath

.github/workflows/architecture-enforcement.yml

@@ -111,17 +111,17 @@ jobs:
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
-      - name: Setup Idris2
+      - name: Build Idris2 modules (via container)
         run: |
-          # Install Idris2 from package manager or build from source
-          # This is a placeholder - actual installation varies by CI environment
-          echo "Idris2 installation (manual review required)"
-
-      - name: Build Idris2 modules
-        run: |
-          # Build all Idris modules to verify totality proofs
-          idris2 --build proven.ipkg || {
-            echo "❌ Idris2 build failed - proofs are broken"
-            exit 1
-          }
+          # Use the snazzybucket/idris2 container so we don't pay a 10-minute
+          # bootstrap on every job. The container is the same one used locally
+          # to verify proven#9 before merge.
+          docker run --rm \
+            -v "$PWD:/proj" \
+            -w /proj \
+            snazzybucket/idris2:latest \
+            sh -c 'idris2 --build proven.ipkg' || {
+              echo "❌ Idris2 build failed - proofs are broken"
+              exit 1
+            }
           echo "✅ Idris2 modules build successfully with totality checking"

.github/workflows/echidna-verify.yml

@@ -35,7 +35,7 @@ jobs:
 
       - name: Cache Idris 2
         id: cache-idris2
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.idris2

.github/workflows/idris2-ci.yml

@@ -37,7 +37,7 @@ jobs:
 
       - name: Cache Idris 2
         id: cache-idris2
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.idris2
@@ -89,7 +89,7 @@ jobs:
 
       - name: Cache Idris 2
         id: cache-idris2
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.idris2

.github/workflows/publish-crates.yml

@@ -38,7 +38,7 @@ jobs:
         uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable
 
       - name: Cache cargo registry
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cargo/registry