ci(health-check): rewire cache to match docker-new restructure

[xmfcx]

• Parent Issue: Simplify the docker images and workflows #6852
• Scope the registry cache tags to health-check's own namespace: health-check-<build-type>-humble-<platform>-<ref> with -main as fallback read and a current-ref write (mode=max, ignore-error=true). Mirrors the pattern used by the main docker-build-new pipeline.
• Add read-only BuildKit mount cache restore + buildkit-cache-dance@v3 injection fed by the main pipeline's buildkit-mounts-ci-universe-humble-<platform>-* tarballs (apt / apt-lists / ccache / pip / pipx, IDs matched to the main build). Health-check never writes back.
• Compute a sanitized ref_name output (replaces / with -) so branch names like feat/foo produce valid registry tags.

Why

The previous buildcache-new:humble-<platform>-main / buildcache-new:<build-type>-humble-<platform>-main tags live in the main docker-build-new pipeline's registry namespace. Sharing scope meant health-check runs could overwrite each other's or main's entries, and the tag layout didn't reflect the new per-distro / per-arch / per-ref structure. Giving health-check its own health-check-* prefix keeps caches isolated; read-only mount restore lets health-check warm apt/ccache/pip/pipx from tarballs main already paid to produce.

---

• 4 of 6 PRs splitting ci(docker-new): split base-cuda layer and restructure CI pipelines #7025. Builds on ci(health-check): run on push to main + split into pr / main / reusable #7030 (merged).
• The buildkit-mounts-ci-universe-humble-<platform>-* tarballs that this reads are produced by the main docker-build-new pipeline. Until the next PR in the stack (docker-new restructure) lands, those tarballs don't exist and cache-restore will stay a miss — benign, just no mount reuse.

Test plan

• Trigger a health-check PR run (run:health-check label). Confirm the 🔨 Build Autoware step's set: block references the new scope: ghcr.io/<repo>-buildcache-new:health-check-<build-type>-humble-<platform>-<ref_name> (cache-from + cache-to) plus health-check-*-main (cache-from fallback).
• Confirm the 💾 Restore BuildKit cache mounts (read-only) step runs and logs either Cache restored from key: buildkit-mounts-ci-universe-humble-<platform>-... (hit) or Cache not found (miss — expected before PR 5 lands).
• Confirm the 💉 Inject BuildKit cache mounts step completes without error even on a miss (inject tolerates empty cache-mounts/).
• Dispatch health-check from the Actions UI and verify the cache-to write lands: docker manifest inspect ghcr.io/<repo>-buildcache-new:health-check-main-humble-amd64-main should resolve after the run.

[github-actions]

Thank you for contributing to the Autoware project!

🚧 If your pull request is in progress, switch it to draft mode.

Please ensure:

• You've checked our contribution guidelines.
• Your PR follows our pull request guidelines.
• All required CI checks pass before marking the PR ready for review.

[xmfcx]

The cache this one will use will come with the next pr 😅