Gate cache saves to the default branch (eliminate PR-stranded caches) #111

Problem

Repos consuming swift-build are hitting the 10 GB Actions cache limit. When we broke down a sample of consumer repos, ~90–100% of all cache storage was stranded on refs/pull/<N>/merge refs:

GitHub scopes every cache to the branch that created it. A cache saved during a PR run lives on refs/pull/<N>/merge and can never be restored by any other branch — not even the default branch. After the PR merges it is pure dead weight until 7-day-inactivity or LRU eviction. With active PR churn plus large per-cache sizes (toolchain ~1 GB, SPM .build 100–485 MB), the quota fills with garbage.

Proposal

Gate the cache save step to the default branch while always restoring:

• restore: always (PRs warm-start from the default branch's caches)
• save: only when github.ref == format('refs/heads/{0}', github.event.repository.default_branch)

PRs would reuse the default branch's caches but never create their own, eliminating PR-stranding at the source.

Trade-offs

• A PR that changes Package.resolved / sources won't get an exact-match save until it merges. restore-keys prefix fallback still gives it a warm partial cache, so the hit isn't cold — just not perfect.
• Pairs well with a pull_request: closed cleanup workflow; either alone helps, both is belt-and-suspenders.

Acceptance criteria

• A save-cache input (or automatic default-branch gating) controls whether caches are written
• Default behavior no longer writes caches on PR refs
• Restore still runs on PRs with restore-keys fallback
• README documents the behavior and the storage rationale