ci: mac source build fails when SDK cache entry is absent #7461

Summary

The mac-build / Build source job fails before configuration or compilation whenever the exact macOS SDK cache entry is absent. The prerequisite cache-check job successfully downloads and extracts the SDK, but cannot persist it when running for a fork PR because its token has no writable cache scope.

Observed on #7460:

• Failing source-build job: https://github.com/dashpay/dash/actions/runs/29316323933/job/87031475443
• SDK cache-check job: https://github.com/dashpay/dash/actions/runs/29316323933/job/87031424299
• Exact missing key: depends-sdks-3b862087d606856e3a05b094cf50293dbb11d6dc15c627cac91fde000534c962

Failure mode

The x86_64-apple-darwin / Check cache job reports:

Cache not found for input keys: depends-sdks-...
Downloading macOS SDK...
Verifying macOS SDK...
Extracting macOS SDK...
Failed to save: Unable to reserve cache with key depends-sdks-.... More details: cache write denied: token has no writable scopes

Because the ordinary depends cache is already present, x86_64-apple-darwin / Build depends is skipped. The later mac-build / Build source job then performs an exact restore with fail-on-cache-miss: true and exits immediately:

Failed to restore cache entry. Exiting as fail-on-cache-miss is set.

Root cause

The workflow assumes the SDK downloaded in the cache-check job will be available to a separate source-build job through actions/cache. That assumption fails for fork PR tokens, which can read but cannot create the missing repository cache entry. The downloaded SDK is discarded with the cache-check runner.

This is independent of the PR source diff. In #7460, only C++ unit-test fixture files changed; .github/workflows/build-src.yml, .github/workflows/build-depends.yml, and depends/hosts/darwin.mk are unchanged from develop.

Reproduction

1. Remove or expire the exact depends-sdks-${{ hashFiles('depends/hosts/darwin.mk') }} cache entry.
2. Trigger the build workflow from a fork PR while the ordinary macOS depends cache is still present.
3. Observe the cache-check job download the SDK but fail to save it because the token lacks writable cache scope.
4. Observe the depends-build job get skipped and the mac source-build job fail its exact SDK restore before compilation.

Possible direction

Carry the downloaded SDK to downstream jobs as a same-run artifact, make the mac source-build job prepare the SDK on an exact cache miss, or ensure a trusted workflow seeds the exact SDK cache key before untrusted PR builds consume it.