ci: re-enable cache push step (named-volume bind for relative path)

runner/compose.yml

@@ -18,3 +18,24 @@ services:
       - ./config.yaml:/config.yaml:ro
       - ./data:/data
       - /var/run/docker.sock:/var/run/docker.sock
+      # Binary cache — `validate-pr.yml`'s push step writes `$out` NAR
+      # archives here. Named volumes (defined below) make the same
+      # storage reachable from both this runner container AND every
+      # job container act_runner spawns. nginx (on the host) serves
+      # ./cache/store over HTTPS for consumers' substituter config.
+      - cargoxx-cache-store:/srv/cargoxx-cache/store
+      - cargoxx-cache-keys:/srv/cargoxx-cache/keys:ro
+
+volumes:
+  cargoxx-cache-store:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: "${PWD}/cache/store"
+  cargoxx-cache-keys:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: "${PWD}/cache/keys"