perf(dev): cache cargo build by fork-tree fingerprint (bd openlock-b5k)

[vessux]

Summary

• In dev mode (openshell-fork/.git present), getGatewayBinary / getSupervisorBinary were calling cargo build -p ... --release on every startGateway — and since the gateway stops when no sandboxes remain, that hit every new session. Release relinks after an upstream rebase or build-script mtime churn burned 10-30s+.
• Wrap buildFromSource with buildFromSourceCached: fingerprint the fork tree (git rev-parse HEAD + git diff HEAD + untracked names → sha256), key a per-fingerprint cache under ~/.cache/openlock/dev-bin/<fp>/<binName>[-target], copy the release artifact in on first build, return the cached path on subsequent calls.
• OPENLOCK_REBUILD=1 forces a rebuild. The prod (ensureFromRelease) path is untouched.

Verification

• Smoke-test (cold cache → warm cache, host gateway):
  • First call: 190145 ms (full cargo release build)
  • Second call: 74 ms (cache hit, Using cached openshell-gateway (5bcd603cc8f7912c))
• bun run typecheck, bun run lint, bun run knip: clean.
• bun test: same baseline as main (1 pre-existing unrelated failure from a vendored z3 test under openshell-fork/target/).

Test plan

• In dev mode, run an openlock session; observe Building openshell-server... once, then Using cached openshell-gateway (...) on subsequent gateway starts.
• Edit a fork file; observe a rebuild on the next call (new fingerprint).
• OPENLOCK_REBUILD=1 openlock ... rebuilds even on cache hit.
• Linux dev path still rebuilds openshell-sandbox directly (no zigbuild); Mac dev path still uses zigbuild + linux target.

Closes openlock-b5k.