[CI] Speed up dependency install: dual-ABI Rust ext cache and prevalidation pruning (#33619)

.github/workflows/seed-rust-ext-cache.yml

@@ -10,6 +10,8 @@ on:
     paths:
       - 'rust/**'
       - 'python/setup.py'
+      # The key's prefix lives in this file, so a bump there also moves the key.
+      - '.github/workflows/_pr-test-rust-ext-build.yml'
   workflow_dispatch:
 
 # Only the newest merge needs to seed; earlier ones are already stale.
@@ -17,9 +19,10 @@ concurrency:
   group: seed-rust-ext-cache
   cancel-in-progress: true
 
-# Declaring permissions at all drops everything not listed, and check-maintenance
-# needs issues: read to reach the maintenance issue.
+# Declaring permissions at all drops everything not listed. issues: read for
+# check-maintenance; actions: read for the restore job's gh cache list.
 permissions:
+  actions: read
   contents: read
   issues: read