Retain Rust build caches and trim streamer dependencies

Implement user-approved build-time improvements following the completed compilation investigation: preserve same-name release BuildKit state without retaining credentials; make gst-recording S3 optional with ruststreamer explicitly opting in; restrict image codecs to PNG/JPEG/WebP/GIF consistently; add Gitea-compatible Cargo CI caching and share serial Check/Test job artifacts. Keep existing check/test coverage, release serialization, rootless isolation and runtime optimizations. No new Rust dependencies, compiler/profile tuning, production deployment or publication. Validate default/no-S3 and S3 feature builds/tests, all supported image codecs and malformed input, dependency graph exclusions, formatting/workspace checks/tests and release tooling; test cache lifecycle/workflow where feasible and explicitly record live-CI/performance limitations. Implemented on perf/retain-rust-build-caches; committed as 08d2002 (perf: Trim streamer AWS and image dependencies) and 025e8cd (perf: Retain release and CI build caches), pushed with upstream tracking. Working tree is clean. Release cleanup retains same-name BuildKit state with --keep-state while removing credentials, with deployment/buildkit.toml GC policy (10GB floor / 40GB usage trigger / 50GB free-space target). Recording S3 dependencies/module/upload APIs/helpers are gated behind s3; ruststreamer opts in and redundant direct AWS declarations are removed. One workspace image dependency enables only PNG/JPEG/WebP/GIF; lockfile sheds unused codec packages. CI combines serial Check/Test, restores registry/git/target via actions/cache v4 keyed on compiler/native versions and manifests/lock/config; only successful main/master pushes save. CARGO_INCREMENTAL=0 keeps CI incremental scratch data out of caches. Includes an isolated recording-without-S3 test step and unchanged full workspace check/test coverage. Branch protection API returned no rules before combining job contexts. Added supported-codec decode/Cairo regression and S3 sidecar-upload selection regression; preserved existing S3 deletion test. Verified: cargo fmt --all --check; cargo check --offline --locked --workspace --all-targets; cargo test --offline --locked --workspace (456 passed, 5 hardware/live-service opt-ins ignored); recording no-default-feature tests (8 passed), S3-enabled tests (10 passed), standalone local-streamer all-target check and library tests (83 passed); affected-package all-target clippy completed with existing warnings. 29 release/deployment Python tests pass. Dependency graph asserts local-streamer 355 packages/no AWS SDK, ruststreamer 456 packages/retains S3, neither has rav1e/ravif/EXR/TIFF. Workflow YAML parsed and shell syntax checked; actual cache fingerprint script executed; temporary-home credential setup verifies unchanged pinned host key parses with ssh-keygen and key file is mode 600; both CI and release credential cleanup exercised, including simulated builder-removal failure. Real local Docker BuildKit smoke created a uniquely named builder using the new GC config, wrote a cache mount, removed it with --keep-state, recreated it, changed a build argument to force rerunning the RUN step and successfully read the preserved mount. Smoke builder/state volume removed; no image published. Evidence /tmp/streaming-buildkit-smoke-wfm1atmh/smoke.log and /tmp/streaming-compile-investigation/implementation-*.log. Static four-perspective patch review completed without actionable findings; live Gitea Runner 5.2/actions/cache v4 restore/save and actual release execution remain unverified until publication. No wall-time improvement is claimed from graph counts or the small cache smoke. No host configuration, deployment, registry publication or new Rust dependency was introduced. Pull request #135: https://git.kaukus.no/Kaukus/streaming-engines/pulls/135 — perf: Reuse Rust build caches and trim streamer dependencies. Open, ready for review; head perf/retain-rust-build-caches, base main. Full base comparison contains only this session's two commits across 12 files. Existing validation remains applicable; final formatting and diff whitespace checks pass. Actual Gitea cache restore/save and release execution still require workflow execution. Task status unchanged by PR administration.