ci: activate shared PR dependency cache restores (#13302)

## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - PR checks share a repository cache budget with post-merge cloud
verification.
> - Per-PR dependency store copies consume about 700 MB each and
displace useful build caches.
> - The reviewed workflow now restores shared dependency caches without
saving PR copies.
> - The public entry point must pin an approved immutable workflow
before it can use AWS runners.
> - This PR activates the merged workflow after the runner group
accepted its exact SHA.
> - Native verification and the app build also run in parallel, as
defined in the merged workflow.

## Linked Issues or Issue Description

Refs #13300. Refs #13301.

The cache definition is merged, and its exact SHA is authorized in the
restricted runner group. This PR activates it. Its base also contains
the two synthetic fixture fixes from #13301. No duplicate activation PR
was found.

## What Changed

- Advance the `pr-trusted.yml` pin from
`03609aa6ecc9a047ed53d6b6469d8be554fbc46d` to merged commit
`44dde2dec42a22746a2f36b595acacc9ccfa1df6`.
- Update the adjacent pin comment to identify #13300 and the activated
behavior.
- Activate restore-only pnpm caching and removal of redundant Node setup
steps from #13300.
- Activate the already-merged separate native verification job, required
by the aggregate `verify` check. The app build no longer waits for
native verification inside the same job.
- Activate the merged module-boundary and source-verification checks and
explicit Runner Evalbook viewer build.

## Verification

- Passed all 505 workflow, routing, cache, sharding, and
source-verification tests.
- Passed `actionlint` for both workflow files and `git diff --check`.
- Passed the runner infrastructure's workflow routing regression tests.
- Confirmed that the gate is unchanged between the old and new workflow
definitions. The restricted runner group permits the exact merged SHA
and retains its existing workflow pins.
- Full workspace typecheck and build passed on the timeout-fix branch.
Its 107 targeted runner tests and all Linux CI groups passed. The broad
local Mac test command had 15 unrelated permission and
missing-skill-path failures, documented in #13301; it stopped before
later groups.
- [Current-head CI run
34662664879](https://github.com/paperclipai/paperclip/actions/runs/34662664879)
passed. All 33 checks are green or intentionally skipped at
`ded4f1d093644b9279cdf56457f69a196fcf8cc2`. Greptile is 5/5, with no
unresolved findings.
- The live build restored the master pnpm cache, downloaded the resolved
lockfile artifact, and completed a frozen install. It had no
dependency-cache upload step. GitHub reports zero cache entries for this
PR. Native verification and the app build started together and both
passed.
- [Post-merge cloud readiness for
#13301](https://github.com/paperclipai/paperclip/actions/runs/34662389233)
passed all 30 jobs in 12m42s from merge. Native verification restored
the master Rust cache and passed the formerly failing fixtures.

## Risks

A new PR-only dependency can require a download until a master cache
contains it. The new pin also activates the merged workflow changes
listed above, so the live PR must pass all checks. The repository
storage cap is still 10 GB; this PR does not increase it. No allowlist
or runner permission logic changes.

## Model Used

OpenAI GPT-6 through Codex, with reasoning, repository tools, and code
execution. The exact serving model ID and context window are not exposed
by this environment.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>

.github/workflows/pr.yml

@@ -10,5 +10,5 @@ permissions:
 
 jobs:
   ci:
-    # Pin: #12858 merge — docker context integrity gate + traceability context fix.
-    uses: paperclipai/paperclip/.github/workflows/pr-trusted.yml@03609aa6ecc9a047ed53d6b6469d8be554fbc46d
+    # Pin: #13300 merge — restore-only dependency caches and parallel native verification.
+    uses: paperclipai/paperclip/.github/workflows/pr-trusted.yml@44dde2dec42a22746a2f36b595acacc9ccfa1df6