ci: unblock Idris 2 verification on every PR (#10)

The Idris 2 CI workflow on `main` has been red since 2026-03-29 (6+
weeks). Root causes:

1. `actions/cache@0c45773…` (v4.0.2) is now deprecated by GitHub and
auto-fails every job that pins it. Affects four workflows: idris2-ci.yml
(build + docs), echidna-verify.yml (Verify Idris 2 Proofs),
publish-crates.yml (cargo cache).

2. architecture-enforcement.yml's `verify-idris-build` job has only a
`echo "Idris2 installation (manual review required)"` placeholder where
the install step should be. `idris2 --build` then runs against an empty
PATH and emits the misleading "❌ Idris2 build failed - proofs are
broken" message.

This commit:

- Bumps actions/cache from v4.0.2 (deprecated SHA
0c45773b623bea8c8e75f6c82b208c3cf94ea4f9) to v4.3.0 (SHA
0057852bfaa89a56745cba8c7296529d2fc39830) in all four workflows.
casket-pages.yml was already on v4.3.0, so the whole repo is now
consistent.

- Replaces the verify-idris-build placeholder with a real build that
uses the `snazzybucket/idris2:latest` container. This is the same
container used locally to verify proven#9 before merge, so the CI signal
will match the manual verification process and we don't pay a ~10-minute
idris2 source bootstrap per job.

Out of scope (left for follow-up):
- hypatia-scan job assumes `../hypatia/elixir-scanner` exists in the
runner workspace, which it doesn't — a sibling-repo clone step is
needed. Tracked separately.
- enforce-idris-only flags ~80 pre-existing `bindings/rust/src/
safe_*.rs` files. The workflow's SOLUTION text says delete them but this
needs a human-in-the-loop policy call. Tracked separately.

Author: hyperpolymath

.github/workflows/architecture-enforcement.yml

@@ -111,17 +111,17 @@ jobs:
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
-      - name: Setup Idris2
+      - name: Build Idris2 modules (via container)
         run: |
-          # Install Idris2 from package manager or build from source
-          # This is a placeholder - actual installation varies by CI environment
-          echo "Idris2 installation (manual review required)"
-
-      - name: Build Idris2 modules
-        run: |
-          # Build all Idris modules to verify totality proofs
-          idris2 --build proven.ipkg || {
-            echo "❌ Idris2 build failed - proofs are broken"
-            exit 1
-          }
+          # Use the snazzybucket/idris2 container so we don't pay a 10-minute
+          # bootstrap on every job. The container is the same one used locally
+          # to verify proven#9 before merge.
+          docker run --rm \
+            -v "$PWD:/proj" \
+            -w /proj \
+            snazzybucket/idris2:latest \
+            sh -c 'idris2 --build proven.ipkg' || {
+              echo "❌ Idris2 build failed - proofs are broken"
+              exit 1
+            }
           echo "✅ Idris2 modules build successfully with totality checking"

.github/workflows/echidna-verify.yml

@@ -35,7 +35,7 @@ jobs:
 
       - name: Cache Idris 2
         id: cache-idris2
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.idris2

.github/workflows/idris2-ci.yml

@@ -37,7 +37,7 @@ jobs:
 
       - name: Cache Idris 2
         id: cache-idris2
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.idris2
@@ -89,7 +89,7 @@ jobs:
 
       - name: Cache Idris 2
         id: cache-idris2
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.idris2

.github/workflows/publish-crates.yml

@@ -38,7 +38,7 @@ jobs:
         uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable
 
       - name: Cache cargo registry
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cargo/registry