ci: cache Buildroot dl/ at /tmp/builder-dl (mirrors firmware's dl cache) (#96)

OpenIPC/firmware/.github/workflows/build.yml has a `output/dl` cache
step that mirrors the Buildroot download directory across runs. This
saves both runner-minutes and — importantly — masks transient upstream
mirror failures: once any cron has cached the canonical tarball for a
package, every subsequent run reuses it regardless of whether the
primary URL is healthy that day.

builder's master.yml + build-one.yml had no equivalent. Each cron run
fully re-downloads the entire dl/ tree, so every package's upstream
must be healthy in every run. Hit hard 2026-05-24 by
wireguard-tools-1.0.20210914.tar.xz: it's served from a cgit
`snapshot/` URL on git.zx2c4.com which regenerates the tarball
per-request with shifting sha256, and `sources.buildroot.net` also
served drifted bytes — see kaeru
'wireguard-zx2c4-tarball-regeneration-hash-drift'. Result: random
matrix entries fail with hash mismatches each cron, with selection
roulette-style (93 boards enable wireguard; on any given run a few
roll snake-eyes on the download).

Mirror firmware's pattern with one wrinkle: builder.sh does
`rm -rf openipc` at the top of every run to force a clean re-clone of
firmware, which would obliterate `openipc/output/dl/` if we cached the
default path. Cache `/tmp/builder-dl` instead (outside the openipc
tree) and point Buildroot at it via BR2_DL_DIR env var, honored per
Buildroot manual section "Location of source tarballs". Same restore +
save lifecycle as firmware's, same monthly key shape.

Effect:
  - First cron after merge: full download as usual; warms /tmp/builder-dl.
  - Subsequent crons: instant cache hit for unchanged packages; only
    re-download for version bumps. Removes the wireguard-roulette class
    of failure entirely once cache is populated.

build-one.yml gets the same treatment so single-board dispatches share
the cache pool.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/master.yml

@@ -195,6 +195,30 @@ jobs:
           path: /tmp/ccache
           key: ${{matrix.platform}}-${{env.CACHE_DATE}}
 
+      # builder.sh does `rm -rf openipc` at the top of every run to force a
+      # clean re-clone of OpenIPC/firmware, which also nukes the default
+      # `openipc/output/dl/` directory Buildroot uses for downloaded source
+      # tarballs. Without a cache, every cron run re-downloads ~1-3 GB of
+      # tarballs from upstream mirrors — and any one of them randomly
+      # failing (e.g. cgit `snapshot/` URLs that regenerate tarballs per
+      # request with shifting sha256, like wireguard-tools on
+      # git.zx2c4.com) takes down the matrix entry for that board. See
+      # kaeru wireguard-zx2c4-tarball-regeneration-hash-drift for the
+      # specific incident this caching addresses.
+      #
+      # Cache to /tmp/builder-dl (outside the openipc/ tree so builder.sh's
+      # rm -rf doesn't touch it) and point Buildroot at it via BR2_DL_DIR
+      # env var (honored per Buildroot manual section "Location of source
+      # tarballs"). Mirrors OpenIPC/firmware/.github/workflows/build.yml's
+      # output/dl cache, adapted for builder's clean-clone behavior.
+      - name: Setup dl cache
+        if: env.RUN
+        uses: actions/cache@v4
+        with:
+          path: /tmp/builder-dl
+          key: builder-dl-${{env.CACHE_DATE}}
+          restore-keys: builder-dl-
+
       - name: Build firmware
         if: env.RUN
         run: |
@@ -206,6 +230,9 @@ jobs:
           mkdir -p /tmp/ccache
           ln -s /tmp/ccache ${HOME}/.ccache
 
+          mkdir -p /tmp/builder-dl
+          export BR2_DL_DIR=/tmp/builder-dl
+
           NAME=${{matrix.platform}}
           # Retry budget for transient upstream toolchain/CDN flakes
           # (matches OpenIPC/firmware/.github/workflows/build.yml).