Benchmark a pinned Linux CI image for Tauri system dependencies

[ekalb81]

Summary

The Linux CI lanes install the same Tauri/WebKit build packages in the check, MSRV, coverage, and cache-probe jobs. A pinned CI image may remove repeated package installation and reduce variance, but its pull time must be measured before adoption.

Scope

• Build and version a Linux CI image containing the current Ubuntu 22.04 Tauri/WebKit dependency set.
• Compare a warmed image run against the current apt-based jobs.
• Preserve the existing lockfile, Rust-toolchain, and runner security boundaries.

Acceptance criteria

• Report p50/p95 wall time and runner minutes for current versus image-backed check, MSRV, and coverage lanes.
• Include image pull time and cache hit behavior in the comparison.
• Adopt the image only if it improves the measured pipeline outcome without reducing reproducibility or expanding capabilities.
• Document the image update and rollback procedure if adopted.

Priority

P3 — optimize only after the release publisher and Cargo-cache experiments have produced stable baseline data.

[ekalb81]

Baseline checkpoint after #80, measured from the three completed main CI runs available on 2026-07-30:

• Linux system-dependency installation: check lane 27s / 23s / 215s; MSRV 32s / 53s / 27s; coverage 47s / 31s / 24s.
• The Cargo cache-probe job was skipped in all three runs, so its experiment has not produced usable data.
• No pinned-image candidate has been run, so the required current-vs-image p50/p95 comparison cannot yet be made.

No workflow change is justified from this sample, especially with the 215s outlier. Keeping the issue open. Next evidence gate: run the cache probe and collect a larger post-#80 baseline before building and benchmarking the pinned image.