perf(ci): cache the per-run toolchain + test-app work (binaryen, emsdk, apps, browsers)

Four new caches in wasm-build.yml, keyed on their real inputs:

- Binaryen post-process tools (bin/ only, keyed on the submodule SHA): on a
  hit BINARYEN_TRUST_PREBUILT=1 tells build-wasm-opt.sh to skip cmake+ninja
  and trust the restored binaries (~46s/run). The guard is env-gated so local
  pass iteration (uncommitted sources, same SHA) is unaffected.
- Built wx test apps (tests/apps minus kicad/ staging + gal-webgl/): skips
  the whole build step on a hit (~3 min — the post-link hoist+asyncify over
  ~74 apps dominates). Key covers wx SHA + kicad SHA (some apps compile real
  KiCad sources: thread_pool.cpp, libcontext), binaryen SHA, tracked app
  sources, and the build/post-link scripts + shims. Gated on a wx cache HIT:
  the app build creates the libwx_*.a symlinks the GAL link needs, so on a
  wx rebuild the apps must rebuild too.
- Host emsdk (tools/emsdk, keyed on the pinned EMSCRIPTEN_VERSION): mostly
  availability insurance — a fresh install is only ~23s but pulls ~340 MB
  from github.com + storage.googleapis.com on every run. downloads/ tarballs
  are pruned before the post-job save.
- Playwright browsers (~/.cache/ms-playwright keyed on tests/package-lock).

Warm-cache runs should drop from ~12 min to ~8-8.5 min (e2e suites are the
floor). Measured baselines from runs 28577824366 / 28520845242.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XeiSRRScdaox5jBueJNcyG

scripts/binaryen-hoist-pass/build-wasm-opt.sh

@@ -22,6 +22,17 @@ if [ ! -f "${SRC}/src/passes/HoistCppCatches.cpp" ]; then
     exit 1
 fi
 
+# CI fast-path: the workflow cache-restores bin/ keyed on the exact submodule SHA and
+# sets this var on a hit, so the restored binaries are authoritative — skip cmake+ninja.
+# Never set it locally when iterating on the pass: uncommitted source edits would be
+# silently ignored (the SHA key can't see them).
+if [ "${BINARYEN_TRUST_PREBUILT:-0}" = "1" ] \
+   && [ -x "${BUILD}/bin/wasm-opt" ] && [ -x "${BUILD}/bin/wasm-emscripten-finalize" ]; then
+    echo "Using prebuilt Binaryen tools (BINARYEN_TRUST_PREBUILT=1): ${BUILD}/bin" >&2
+    echo "${BUILD}/bin/wasm-opt"
+    exit 0
+fi
+
 # Configure once (mirrors scripts/common/get-wasm-opt.sh's from-source flags).
 if [ ! -f "${BUILD}/build.ninja" ]; then
     echo "Configuring Binaryen submodule build (one-time, ~5 min to build)..." >&2