ci: prime and unify the dependency cache so lockfile changes don't cold-install every job

Previously setup-cache (cache-management.yml) restored a cache blob and auto-saved it
without ever running the install, so a new lockfile hash would save a stale/empty blob
under the new key and every downstream job would cold-install independently and throw
the result away.

Two fixes:
1. Prime on miss: when actions/cache misses in setup-cache, install UV and run
   `make dev-install` (ORB_SKIP_UI_BUILD=1 to skip the bun SPA build) before the
   job ends so actions/cache@v5 auto-saves a fully-populated .venv + ~/.cache/uv
   under the new key. Exactly one install runs per (python-version, lockfile-hash)
   combination; all downstream jobs hit the warm cache via setup-uv-cached.

2. Unified key base: replace the eight distinct cache-key-base values
   (test-deps, quality-deps, changelog-validation, container-build, docs-deps,
   test-matrix/test-deps, workflow-validation, dependabot) with a single "deps"
   base across all callers. Every workflow installs the identical --all-groups env
   via make dev-install, so one shared cache entry is correct and lets all
   workflows share a single warm blob. The reusable-test.yml cold-install fallback
   key format is updated to match (test-deps-py -> deps-py).

Author: fgogolli

.github/workflows/cache-management.yml

@@ -12,7 +12,7 @@ on:
         required: true
         type: string
       cache-key-base:
-        description: 'Base cache key (e.g. test-deps, quality-deps)'
+        description: 'Base cache key — all callers must pass "deps" for the shared env'
         required: true
         type: string
       python-version:
@@ -22,11 +22,11 @@ on:
     outputs:
       cache-key:
         description: 'Generated cache key for use in setup-uv-cached'
-        value: ${{ jobs.generate-cache-key.outputs.cache-key }}
+        value: ${{ jobs.setup-cache.outputs.cache-key }}
 
 jobs:
-  generate-cache-key:
-    name: Generate Cache Key
+  setup-cache:
+    name: Prime Dependency Cache
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -63,3 +63,14 @@ jobs:
         restore-keys: |
           ${{ inputs.cache-key-base }}-py${{ inputs.python-version }}-
           ${{ inputs.cache-key-base }}-
+
+    - name: Install UV
+      if: steps.cache.outputs.cache-hit != 'true'
+      uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
+
+    - name: Populate cache (install dependencies on miss)
+      if: steps.cache.outputs.cache-hit != 'true'
+      env:
+        # Suppress the bun SPA build — this job only primes the Python env.
+        ORB_SKIP_UI_BUILD: "1"
+      run: make dev-install

.github/workflows/changelog-validation.yml

@@ -32,7 +32,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: changelog-validation
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   validate-changelog:

.github/workflows/ci-quality.yml

@@ -46,7 +46,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: quality-deps
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   auto-format:

.github/workflows/ci-tests.yml

@@ -49,7 +49,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: test-deps
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   # Parallel test-group matrix (T2613): splits the non-provider test corpus

.github/workflows/dependabot.yml

@@ -32,7 +32,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: dependabot
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   update-uv-lock:

.github/workflows/dev-containers.yml

@@ -82,7 +82,7 @@ jobs:
       # fell through to the SHA-based fallback arm in cache-management.yml, producing
       # a cold key on every run and forcing a full dep reinstall each time.
       cache-type: dependencies
-      cache-key-base: container-build
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   container-pipeline:

.github/workflows/docs.yml

@@ -56,7 +56,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: docs-deps
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   build:

.github/workflows/reusable-test.yml

@@ -116,7 +116,7 @@ jobs:
             ${{
               inputs.cache-key != ''
               && inputs.cache-key
-              || format('test-deps-py{0}-{1}',
+              || format('deps-py{0}-{1}',
                    inputs.python-version || inputs.default-python-version,
                    hashFiles('.project.yml', 'pyproject.toml', 'uv.lock'))
             }}

.github/workflows/test-matrix.yml

@@ -28,7 +28,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: test-deps
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   unit-tests:

.github/workflows/validate-workflows.yml

@@ -35,7 +35,7 @@ jobs:
     uses: ./.github/workflows/cache-management.yml
     with:
       cache-type: dependencies
-      cache-key-base: workflow-validation
+      cache-key-base: deps
       python-version: ${{ needs.config.outputs.default-python-version }}
 
   validate-workflows: