ci: latest action majors, rolling cache keys and Test timeouts

- Actions moved to their latest majors: checkout v4->v7, cache v4->v6
  (restore/save too), upload-artifact v4->v7, download-artifact v4->v8,
  action-gh-release v2->v3. rust-cache and rust-toolchain already track
  their latest majors.
- vcpkg caches now save under a per-run key and restore through
  `restore-keys` (newest entry for the exact manifest first, then the
  newest entry for that OS): saving can no longer fail because the key
  already exists ("update if present, create if not"), and a manifest
  change reuses vcpkg's content-addressed archives instead of rebuilding
  every port.
- Every Test step gets an explicit 40-minute bound. macOS had no watchdog
  at all (the Linux/openKylin scripts carry their own) and the current run
  has been sitting in Test with no progress; a hung suite now fails the
  step instead of running to the job timeout.

.github/workflows/cd.yml

@@ -55,7 +55,7 @@ jobs:
           esac
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: true
 
@@ -108,14 +108,17 @@ jobs:
           echo "VCPKG_ROOT=$PWD/.cache/vcpkg" >> "$GITHUB_ENV"
 
       - name: Cache vcpkg artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             vcpkg_installed
             ~/.cache/vcpkg/archives
           # The distro prefix matters: the same Ubuntu-runner cache scope
           # backs three different container distros.
-          key: vcpkg-${{ matrix.distro }}-x64-linux-${{ hashFiles('vcpkg.json') }}
+          key: vcpkg-${{ matrix.distro }}-x64-linux-${{ hashFiles('vcpkg.json') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            vcpkg-${{ matrix.distro }}-x64-linux-${{ hashFiles('vcpkg.json') }}-
+            vcpkg-${{ matrix.distro }}-x64-linux-
           save-always: true
 
       - name: Install dependencies (vcpkg manifest)
@@ -162,7 +165,7 @@ jobs:
         shell: bash
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: oak-linux-${{ matrix.distro }}
           path: |
@@ -180,7 +183,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: true
 
@@ -214,12 +217,15 @@ jobs:
           echo "VCPKG_ROOT=$PWD/.cache/vcpkg" >> "$GITHUB_ENV"
 
       - name: Cache vcpkg artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             vcpkg_installed
             ~/.cache/vcpkg/archives
-          key: vcpkg-${{ runner.os }}-appimage-${{ hashFiles('vcpkg.json') }}
+          key: vcpkg-${{ runner.os }}-appimage-${{ hashFiles('vcpkg.json') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            vcpkg-${{ runner.os }}-appimage-${{ hashFiles('vcpkg.json') }}-
+            vcpkg-${{ runner.os }}-appimage-
           save-always: true
 
       - name: Install dependencies (vcpkg manifest)
@@ -255,7 +261,7 @@ jobs:
         run: cargo packager --release --formats appimage
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: oak-linux-appimage
           path: target/release/*.AppImage
@@ -267,7 +273,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: true
 
@@ -293,12 +299,15 @@ jobs:
           echo "VCPKG_ROOT=$PWD/.cache/vcpkg" >> "$GITHUB_ENV"
 
       - name: Cache vcpkg artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             vcpkg_installed
             ~/.cache/vcpkg/archives
-          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}
+          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-
+            vcpkg-${{ runner.os }}-
           save-always: true
 
       - name: Install dependencies (vcpkg manifest)
@@ -356,7 +365,7 @@ jobs:
             -srcfolder dmg-staging -ov -format UDZO Oak-macOS-arm64.dmg
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: oak-macos
           path: Oak-macOS-arm64.dmg
@@ -373,7 +382,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: true
 
@@ -400,12 +409,15 @@ jobs:
           "VCPKG_ROOT=$env:GITHUB_WORKSPACE\.cache\vcpkg" >> $env:GITHUB_ENV
 
       - name: Cache vcpkg artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             vcpkg_installed
             ~/AppData/Local/vcpkg/archives
-          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}
+          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-
+            vcpkg-${{ runner.os }}-
           save-always: true
 
       - name: Install dependencies (vcpkg manifest)
@@ -460,7 +472,7 @@ jobs:
         run: cargo packager --release --formats nsis
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: oak-windows
           path: target/release/*-setup.exe
@@ -477,13 +489,13 @@ jobs:
     runs-on: warp-ubuntu-latest-x64-8x
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
           merge-multiple: true
 
       - name: Publish release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ github.ref_name }}
           name: ${{ github.ref_name }}