fix(ci): moved bazel repo cache mount outside the runner home

kubelet creates missing subPath mountpoint parents as root, so mounting
the PVC repository cache under ~/.cache left the directory root-owned
and broke both bazel's default output root and zig's wrapper cache
compile (AccessDenied). The mount now lives at /opt/bazel-repo-cache.

.github/actions/bazel-cache/action.yml

@@ -46,10 +46,11 @@ runs:
            if [ -n "${BAZEL_REMOTE_USER:-}" ]; then
              auth="$(printf %s "${BAZEL_REMOTE_USER}:${BAZEL_REMOTE_PASSWORD}" | base64 | tr -d '\n')"
              {
-               # kubelet creates $HOME/.cache root-owned when materializing the
-               # omp-bazel-repo subPath mountpoint, so bazel's default
-               # output_user_root ($HOME/.cache/bazel) is un-creatable; pods
-               # are single-job ephemeral, so RUNNER_TEMP is the right home.
+               # The PVC repo-cache mount lives OUTSIDE $HOME (/opt): kubelet
+               # creates missing mountpoint parents root-owned, and a
+               # root-owned $HOME/.cache breaks bazel's default
+               # output_user_root and zig's wrapper cache. Pods are
+               # single-job ephemeral, so RUNNER_TEMP hosts the output root.
                echo "startup --output_user_root=$RUNNER_TEMP/bazel-root"
                echo "common --config=ci"
                echo "common --config=cache-rw"
@@ -58,7 +59,7 @@ runs:
                echo "common --remote_header='authorization=Basic ${auth}'"
                # PVC-backed shared repository cache (pods are ephemeral; without
                # it every job re-downloads toolchains + crate archives).
-               echo "common --repository_cache=$HOME/.cache/omp-bazel-repo"
+               echo "common --repository_cache=/opt/bazel-repo-cache"
              } > "$rc"
            else
              {

infra/docs/04-arc-and-caching.md

@@ -194,8 +194,11 @@ template:
           # Shared Bazel repository cache: pods are ephemeral, so without it
           # every job re-downloads toolchains and crate archives. Content-
           # addressed and written atomically, safe to share across pods.
+          # Deliberately OUTSIDE $HOME: kubelet creates missing mountpoint
+          # parents root-owned, and a root-owned ~/.cache breaks bazel's
+          # default output root and zig's wrapper cache.
           - name: runner-cache
-            mountPath: /home/runner/.cache/omp-bazel-repo
+            mountPath: /opt/bazel-repo-cache
             subPath: bazel-repo-cache
         resources:
           requests: