perf(ci): drop per-job ripgrep/uv/Python setup, use the baked runner image

Eleven jobs on every push repeated the same three network round-trips
before doing any work: download ripgrep from GitHub releases, run
astral-sh/setup-uv, then `uv python install 3.11`. The 8 test slices,
e2e, lint x2, docker tests, and uv-lockfile-check all paid it, all for
identical bytes. Each hop was also a failure mode — the 2026-07-28
slice-5 incident was a transient setup-uv manifest fetch failing a whole
job, and pinning the version narrowed that window without closing it.

hermes-agent-ci-infra now bakes ripgrep 15.1.0, uv 0.9.28, and CPython
3.11 into nousresearch/nous-gke-runner (same versions, so this is a move
not an upgrade), so these steps are pure overhead. Remove them.

The wheel cache is the one part of setup-uv still worth having: it is
per-workspace, not per-image, and without it `uv sync` re-downloads and
re-builds every wheel — the toolchain would be faster to set up and the
sync dramatically slower, a net loss. Replace `enable-cache: true` with
a small .github/actions/uv-cache composite doing the same actions/cache
on ~/.cache/uv, keyed on pyproject.toml + uv.lock. runner.arch is in the
key because the cache holds built wheels and docker.yml runs on arm64
too; the restore-keys prefix means a stale hit still saves most of the
download, and `uv sync --locked` re-resolves from uv.lock regardless so
a partial hit cannot produce a wrong environment.

lint.yml and uv-lockfile-check.yml only `uv tool install` / `uv lock
--check` and never build a project venv, so they drop the setup step
without needing the cache action at all.

Verified against the built image, running as the `runner` user with
`--network none` so nothing can silently re-download: rg 15.1.0, uv
0.9.28, and `uv python find 3.11` all resolve. With hermes-agent's real
pyproject.toml and uv.lock and no setup step of any kind, `uv sync
--locked --python 3.11 --extra dev` completes in 3s into a working
3.11.14 venv. actionlint is clean (the remaining arc-runner-set and
SC2016 warnings are pre-existing on main).

Depends on the image change landing first: pods pull :latest on start,
so merging this before the image is pushed breaks every runner.

.github/workflows/docker.yml

@@ -154,16 +154,11 @@ jobs:
       # than the build itself.  Reusing the existing daemon state is the
       # cheapest path to coverage on every PR that touches docker code.
       # ---------------------------------------------------------------------
-      - name: Install uv (for docker tests)
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # 8.2.0
-        with:
-          # Pinned: unpinned setup-uv fetches a 'latest' manifest from
-          # raw.githubusercontent.com every job; transient fetch failures
-          # fail the job (2026-07-28 incident). Keep in sync with tests.yml.
-          version: '0.9.28'
-
-      - name: Set up Python 3.11 (for docker tests)
-        run: uv python install 3.11
+      # uv and CPython 3.11 are baked into the nousresearch/nous-gke-runner
+      # image (hermes-agent-ci-infra runner/Dockerfile) — no setup-uv, no
+      # `uv python install`.
+      - name: Restore uv cache (for docker tests)
+        uses: ./.github/actions/uv-cache
 
       - name: Install Python dependencies (for docker tests)
         # ``dev`` extra pulls in pytest, pytest-asyncio —