[caokai674]

Scope

• Keep Linux x86_64/ARM64 native packages and verified release gates; remove Windows/macOS CI and Windows release paths.
• Preserve prepared CI parallelism work, cap Linux Bazel matrix to 4 concurrent jobs and local Bazel workers to 4.
• Share Bazel repository cache across compatible Linux stages and use one bounded action cache path for test, Clippy and release checks.
• Replace cached full Cargo target directories in native packaging with shared download sources and bounded sccache; avoid duplicate cargo-chef compilation in the full suite.
• Add a required upstream-sync CI policy preflight so upstream updates cannot silently reintroduce platform jobs or break required workflow references.
• Remove abandoned upstream publishing workflows and add a scheduled, age-limited Actions cache/diagnostic artifact cleanup (manual runs default to dry-run).

Safety and validation

• This PR targets the unmerged 0.166.0 sync branch; main and PR sync Codefx with Codex rust-v0.166.0 #4 are unchanged until merged.
• No published release assets are deleted by the cleanup job. Manual cleanup defaults to dry-run.
• Build/runtime CI and real cache hit-rate/runner-minutes reductions still require GitHub Actions verification. Keep this PR draft until required checks pass.

Review priorities

1. Verify the merge gate, reusable workflow references and native package manifests on Linux.
2. Check Bazel/Cargo cache hit rates, disk peak, archive sizes and remote BuildBuddy availability.
3. Ensure obsolete upstream publisher paths are not restored by subsequent syncs.