Split CI clippy checks into parallel jobs; move desktop build deps to a dedicated runner image

The single "check" job ran fmt + four clippy variants (native, server,
web, desktop) as sequential steps, so the desktop feature's clippy check
always waited on the other three even though none of them share
dependencies. Splitting each into its own job lets the runner (capacity
2) run them concurrently instead.

Also drops the per-run `apt-get install` for the GTK/WebKit headers
dioxus-desktop needs — those are now baked into a dedicated
`rust-ci-desktop` runner image (schaefera/infrastructure#TBD) so only the
desktop job's image is bigger, not every job's.

Depends on the `rust-ci-desktop` label being registered on the ci-runner
box before this workflow's clippy-desktop job can pick up work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -6,7 +6,14 @@ on:
   pull_request:
 
 jobs:
-  check:
+  fmt:
+    runs-on: rust-ci
+    steps:
+      - uses: actions/checkout@v4
+      - name: Format check
+        run: cargo fmt --check
+
+  clippy-native:
     runs-on: rust-ci
     steps:
       - uses: actions/checkout@v4
@@ -33,36 +40,99 @@ jobs:
           restore-keys: |
             sccache-${{ runner.os }}-
 
-      - name: Add wasm target
-        run: rustup target add wasm32-unknown-unknown
-
-      - name: Format check
-        run: cargo fmt --check
-
       - name: Clippy (native crates)
         run: cargo clippy --workspace --exclude feedsignal-web --all-targets -- -D warnings
 
+  clippy-server:
+    runs-on: rust-ci
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Cache cargo registry and build artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
+      - name: Cache sccache compilation objects
+        uses: actions/cache@v4
+        with:
+          path: /root/.cache/sccache
+          key: sccache-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: |
+            sccache-${{ runner.os }}-
+
       - name: Clippy (web crate, server)
         run: cargo clippy -p feedsignal-web --no-default-features --features server --all-targets -- -D warnings
 
+  clippy-web:
+    runs-on: rust-ci
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Cache cargo registry and build artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
+      - name: Cache sccache compilation objects
+        uses: actions/cache@v4
+        with:
+          path: /root/.cache/sccache
+          key: sccache-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: |
+            sccache-${{ runner.os }}-
+
+      - name: Add wasm target
+        run: rustup target add wasm32-unknown-unknown
+
       - name: Clippy (web crate, wasm client)
         run: cargo clippy -p feedsignal-web --no-default-features --features web --target wasm32-unknown-unknown -- -D warnings
 
+  clippy-desktop:
     # dioxus-desktop (tao/wry) needs GTK/WebKit headers to compile against
-      # on Linux; not baked into the rust-ci image since no other job needs
-      # them.
-      - name: Install desktop build dependencies
-        run: |
-          apt-get update
-          apt-get install -y --no-install-recommends \
-            libgtk-3-dev libwebkit2gtk-4.1-dev libsoup-3.0-dev \
-            libayatana-appindicator3-dev librsvg2-dev libxdo-dev
+    # on Linux; rust-ci-desktop is rust-ci plus those, kept as a separate
+    # image so the other jobs above don't pull a much bigger one for
+    # headers only this job needs.
+    runs-on: rust-ci-desktop
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Cache cargo registry and build artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
+      - name: Cache sccache compilation objects
+        uses: actions/cache@v4
+        with:
+          path: /root/.cache/sccache
+          key: sccache-${{ runner.os }}-${{ github.run_id }}
+          restore-keys: |
+            sccache-${{ runner.os }}-
 
       - name: Clippy (web crate, desktop)
         run: cargo clippy -p feedsignal-web --no-default-features --features desktop --all-targets -- -D warnings
 
   test:
-    needs: check
+    needs: [fmt, clippy-native, clippy-server, clippy-web, clippy-desktop]
     runs-on: rust-ci
     steps:
       - uses: actions/checkout@v4