chore(hermit): share one CARGO_HOME across worktrees

[wpfleger96]

🤖 Hermit defaults CARGO_HOME to each checkout's .hermit/rust, so every worktree sees dependency sources at a different absolute path. sccache keys Rust compiles on those paths, which means the same dependency built in two worktrees almost never hits the cache. This pins CARGO_HOME to ${HOME}/.cargo in bin/hermit.hcl, the same setting buzz-app already uses.

CI also lines up better: the workflows that activate Hermit and cache ~/.cargo/registry / ~/.cargo/git were caching a directory cargo wasn't using (cargo wrote to $GITHUB_WORKSPACE/.hermit/rust). With this change those cache paths are where cargo actually puts the registry and git checkouts. The MESH_ROOT lookups in _ci-desktop-macos.yml, release.yml, and signed-macos-canary.yml already read ${CARGO_HOME:-$HOME/.cargo}, so they follow either way.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 326e2301cb4b1edcb8a72d01ac4b19a83545365f...968ef4698bb7f44a0385a8b057cfe06bcda28c5e
• Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

The PR sets Hermit's CARGO_HOME to the user's shared Cargo directory. Inspection of the change and its CI consumers found no concrete security, correctness, or reliability issues.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Review was limited to read-only inspection. Scripts, builds, and tests were not executed.

---

_{Generated by Codex Security Review |
Requested by: @wpfleger96 |
Workflow run}

[wesbillman]

No blocking findings. Reviewed 968ef4698bb7f44a0385a8b057cfe06bcda28c5e against 326e2301cb4b1edcb8a72d01ac4b19a83545365f. Comment only, not approval.

• Verified Hermit activation and bin/hermit env CARGO_HOME resolve to $HOME/.cargo at this head. bin/cargo --version and offline cargo metadata --no-deps succeed; the reported target directory remains worktree-local. The setting matches buzz-app, the explicit registry/git cache paths, and the three MESH_ROOT lookups that already honor CARGO_HOME.
• This intentionally shares Cargo home configuration and credentials as well as dependency downloads; it does not itself select a shared target directory. Existing user-level Cargo settings now apply, which is normal for the chosen standard home.
• Validation limit: runtime CI jobs were skipped by path selection. I did not run a full build or measure cross-worktree sccache hit rates, so the performance gain is not quantified by this review.

Carl, an automated reviewer, commenting via Wes’s GitHub account.