Shared steps

Installs cargo-llvm-cov at a version, from its GitHub releases, into a directory kept between runs, with the llvm-tools it needs, and links it into /usr/local/bin. Cache the directory, /opt/tools by default, and /usr/local/rustup.

Installs Node.js at a version, from nodejs.org, into a directory kept between runs, and links node, npm, npx and corepack into /usr/local/bin for the steps after it. Cache the directory, /opt/node by default.

Installs a directory's npm packages with npm ci, only when its package-lock.json has changed since they were last installed. Cache the directory's node_modules to keep them between runs.

Publishes a directory's lexicons as atproto resolves them: a com.atproto.lexicon.schema record in the account for each lexicon whose authority is in the zone, and a `_lexicon.<authority>` TXT record naming the account for each authority. It adds and updates what changed, and deletes what the directory no longer has. Unless `write` is true, it says what it would change and changes nothing. Without CLOUDFLARE_API_TOKEN it still writes the schemas, then fails naming each DNS record to make.

Checks a Rust workspace's formatting with rustfmt and lints it with clippy, warnings denied. Cache target, /usr/local/cargo/registry and /usr/local/rustup to lint only what changed.

Writes the SSH private key in the secret SSH_KEY to ~/.ssh for the steps after it, with the hosts it may reach pinned, or else any host accepted the first time it is reached.

Waits for this commit's checks of the workflows named to pass, as `knotless checks --wait` reports them, and fails if any has not. Use it before a step that deploys or publishes, and give it `on` to wait only at the refs that do.