deb: integrate ccache for content-keyed compile reuse

Fresh chroots also mean fresh compiles: nothing survived to make the
recompile-heavy middle of a run cheap. Every deb build now wires a
shared ccache — /var/tmp/pkh/ccache/<slug>/, bind-mounted at the
chroot's /var/cache/pkh-ccache — through a PATH shim rather than CC
environment variables: gcc/g++/cc/c++ symlinks in /usr/lib/pkh-ccache-
shim resolve to the ccache the essentials install, so rules that call
the plain compiler names are cached while explicit exotic compilers
stay untouched. CCACHE_COMPILERCHECK=content is critical — the default
is mtime-based and would never hit across fresh chroots, where every
toolchain's mtime is the extraction's — with CCACHE_BASEDIR=/tmp/pkh-
build and CCACHE_NOHASHDIR=true keying the staged tree's relative
paths, and CCACHE_MAXSIZE=10G (PKH_CCACHE_MAXSIZE overrides).

No mtime clamping anywhere: the tarball extraction preserves mtimes,
so the toolchain and libc headers stay older than carried objects and
make keeps them, while build-dependency reinstalls are newer and make
rebuilds their dependents — ccache turns those into hits, and a real
archive library change is a miss that rebuilds them, exactly the
signal clamping would silence. `pkh deb --no-ccache` skips the shim,
the env and the mount entirely: an escape hatch for rules that
mishandle compiler wrappers (kbuild-style flavour configs).

src/deb/mod.rs

@@ -123,6 +123,10 @@ pub struct DebBuildOptions<'a> {
     /// whether this build's own staged tree is retained. Defaults to a
     /// plain run.
     pub incremental: Incremental,
+    /// Reuse the shared ccache of this target (on by default; `pkh deb
+    /// --no-ccache` disables it — an escape hatch for `debian/rules`
+    /// whose own compiler handling conflicts with the shim).
+    pub ccache: bool,
     /// Where build events (phases, progress, outcome) are reported.
     pub view: &'a dyn BuildView,
 }
@@ -215,6 +219,7 @@ impl Default for DebBuildOptions<'_> {
             jobs: None,
             ctx: None,
             incremental: Incremental::Off,
+            ccache: true,
             view: &QUIET,
         }
     }
@@ -258,6 +263,7 @@ async fn build_binary_package_impl(
         ref jobs,
         ref ctx,
         ref incremental,
+        ccache,
         view,
     } = opts;
     let cwd = cwd.as_deref().unwrap_or_else(|| Path::new("."));
@@ -375,6 +381,8 @@ async fn build_binary_package_impl(
         None => opts.view,
     };
 
+    // The shared ccache of this target — skipped with --no-ccache.
+    let ccache_dir = (session_enabled && ccache).then(|| session::ccache_dir(&identity));
     let mut guard = if let Some(s) = session.clone() {
         Some(
             ephemeral::EphemeralContextGuard::new_for_session(
@@ -384,6 +392,7 @@ async fn build_binary_package_impl(
                 base_ctx.clone(),
                 view,
                 keep_upper,
+                ccache_dir.as_deref(),
             )
             .await?,
         )
@@ -522,6 +531,7 @@ async fn build_binary_package_impl(
                     *jobs,
                     session.as_ref(),
                     build_resume,
+                    ccache,
                 )
                 .await?
             }