perf(infra): bake mold linker + sccache into the golden image

Worker-only ~/.cargo/config.toml (Linux, never plum's macOS): mold via
-fuse-ld=mold (fast cdylib linking) + sccache rustc-wrapper (compiled-crate cache,
warm in the baked image). mold installs via apt or GitHub static-binary fallback;
both gated on install success so a miss never breaks cargo. Verified mold=true
sccache=true in the build.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/packer/provision.sh

@@ -79,7 +79,16 @@ echo "=== [4b/7] build accelerators: mold linker + sccache ==="
 # mold: much faster linking of the big GDExtension cdylib. sccache: caches rustc
 # outputs so fresh workers reuse compiled crates. Both configured ONLY for the
 # build user on the worker (Linux) — never touches plum's macOS .cargo config.
-MOLD_OK=false; apt-get -o DPkg::Lock::Timeout=300 install -y mold && MOLD_OK=true
+MOLD_OK=false
+if apt-get -o DPkg::Lock::Timeout=300 install -y mold 2>/dev/null && command -v mold >/dev/null; then
+  MOLD_OK=true
+else
+  # apt may not carry mold on this image — fall back to the static GitHub release.
+  MV="$(curl -fsSL https://api.github.com/repos/rui314/mold/releases/latest | python3 -c 'import sys,json;print(json.load(sys.stdin)["tag_name"].lstrip("v"))' 2>/dev/null || true)"
+  if [ -n "$MV" ] && curl -fsSL "https://github.com/rui314/mold/releases/download/v${MV}/mold-${MV}-x86_64-linux.tar.gz" | tar -xz -C /usr/local --strip-components=1 2>/dev/null && command -v mold >/dev/null; then
+    MOLD_OK=true
+  fi
+fi
 SCCACHE_OK=false
 as_user "source ~/.cargo/env && (command -v sccache >/dev/null || cargo binstall -y sccache >/dev/null 2>&1 || cargo install sccache)" && SCCACHE_OK=true
 mkdir -p "/home/$BUILD_USER/.cargo"