GHA: use cache-mode

Limit cache access to the minimum required.

Refs:
https://github.blog/changelog/2026-09-10-control-github-actions-cache-access-with-cache-mode/
https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#cache-mode
https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#bypassing-the-default-untrusted-trigger-cache-restriction

Closes #2601

.github/workflows/ci.yml

@@ -17,6 +17,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions: {}
+cache-mode: none
 
 env:
   DO_NOT_TRACK: '1'
@@ -68,7 +69,10 @@ jobs:
           eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
           actionlint --version
           export SHELLCHECK_OPTS='--exclude=1090,1091,2086,2153 --enable=avoid-nullary-conditions,deprecate-which'
-          actionlint --ignore ubuntu-26.04 .github/workflows/*.yml
+          actionlint \
+            --ignore ubuntu-26.04 \
+            --ignore 'unexpected key "cache-mode"' \
+            .github/workflows/*.yml
 
       - name: 'shellcheck GHA'
         run: |
@@ -238,6 +242,7 @@ jobs:
     name: 'linux'
     runs-on: ${{ matrix.compiler == 'clang-tidy' && 'ubuntu-26.04' || (matrix.image || 'ubuntu-latest') }}
     timeout-minutes: 10
+    cache-mode: write
     strategy:
       fail-fast: false
       matrix:
@@ -824,6 +829,7 @@ jobs:
     name: 'msys2'
     runs-on: windows-2022
     timeout-minutes: 10
+    cache-mode: write
     defaults:
       run:
         shell: msys2 {0}  # zizmor: ignore[misfeature]
@@ -1317,6 +1323,7 @@ jobs:
     name: 'curl, CM ${{ matrix.arch }}-${{ matrix.plat }} ${{ matrix.name }}'
     runs-on: '${{ matrix.image }}'
     timeout-minutes: 10
+    cache-mode: write
     defaults:
       run:
         shell: msys2 {0}  # zizmor: ignore[misfeature]