fix(ci): cache vendor build artefacts alongside node_modules

The Windows install action enables the bun-output cache via the
`cache: "true"` input added in `46d98c9756`. On a cache hit it
`tar -xf`s the saved archive and skips `bun install`, but the original
archive only contained `node_modules`. `bun install`'s `prepare` step
runs `cd vendor && npm ci --include=dev`, whose `node rspack`
postinstall lands `vendor/dist/{limiter, ...}` outside that path, so
every cache-hit Windows job now fails at first require with
`Cannot find module '../../../vendor/dist/limiter'`.

Capture `vendor/node_modules` and `vendor/dist` in the archive, fold
`vendor/package-lock.json` into the cache key so a transitive bump
invalidates the entry, and rename the archive plus bump the key
suffix to `-v3` so already-poisoned entries miss.

Author: BridgeAR

.github/actions/install/action.yml

@@ -2,7 +2,7 @@ name: Install dependencies
 description: Install dependencies
 inputs:
   cache:
-    description: Restore and save node_modules.tar between runs of this workflow/job.
+    description: Restore and save the bun-install output tar between runs of this workflow/job.
     required: false
     default: 'false'
 runs:
@@ -12,11 +12,15 @@ runs:
       if: inputs.cache == 'true'
       uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
-        key: install-cache-${{ github.workflow }}-${{ github.job }}-${{ hashFiles('bun.lock') }}-v2
-        path: node_modules.tar
+        # `bun install` runs `prepare`, which `cd vendor && npm ci --include=dev` runs
+        # `node rspack` and lands the bundled artefacts under `vendor/dist`. Both
+        # `vendor/package-lock.json` and `bun.lock` feed the install graph, so the cache
+        # key has to invalidate when either moves.
+        key: install-cache-${{ github.workflow }}-${{ github.job }}-${{ hashFiles('bun.lock', 'vendor/package-lock.json') }}-v3
+        path: install-cache.tar
     - if: inputs.cache == 'true' && steps.install-cache.outputs.cache-hit == 'true'
       shell: bash
-      run: tar -xf node_modules.tar
+      run: tar -xf install-cache.tar
     - if: inputs.cache != 'true' || steps.install-cache.outputs.cache-hit != 'true'
       uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
       env:
@@ -28,4 +32,7 @@ runs:
         command: bun install --linker=hoisted --trust --network-concurrency 8
     - if: inputs.cache == 'true' && steps.install-cache.outputs.cache-hit != 'true'
       shell: bash
-      run: tar -cf node_modules.tar node_modules
+      # `node_modules` alone misses `vendor/dist/*` (produced by the rspack postinstall)
+      # and `vendor/node_modules` (needed for it to re-run on the next miss); without
+      # them, every cache-hit job fails to require `vendor/dist/limiter` and friends.
+      run: tar -cf install-cache.tar node_modules vendor/node_modules vendor/dist