Replace the workflow_run chain with a single same-run build graph

.github/actions/setup-deps/action.yml

@@ -0,0 +1,65 @@
+name: Set up Zerr* dependencies
+description: >
+  Resolve fftw and yaml-cpp once, at the repo root, using a committed profile --
+  the same single resolve that build.sh performs locally, so CI and developer
+  machines share one dependency configuration.
+
+inputs:
+  profile:
+    description: 'Committed conan profile to resolve with, e.g. profiles/macos'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    # Keyed on the profile as well as the OS: windows-mingw and windows-msvc are
+    # both runner.os == Windows but must never share a cache entry, since their
+    # package_ids differ.
+    #
+    # ImageVersion is in the key because the compiler is not. profiles/mingw pins
+    # compiler.version=13 while the runner actually compiles with gcc 16.1.0, so
+    # neither the package_id nor a conanfile/profile hash changes when the image
+    # bumps its toolchain -- conan would restore fftw and yaml-cpp built by the
+    # previous compiler and link them into a core built by the new one. Keying on
+    # the image makes a toolchain change a cache miss, which is the honest outcome.
+    #
+    # No restore-keys, deliberately. A prefix restore is by definition a stale hit,
+    # which is what this key exists to prevent; it also re-saves the restored tree
+    # under the new key, so ~/.conan2 would accrete every historical revision until
+    # it hit the 10GB repository ceiling and started evicting live entries. A full
+    # miss costs one from-source build of fftw and yaml-cpp, which is the correct
+    # price for a changed toolchain.
+    # ImageVersion has to be read in a shell: the `env` context is not populated
+    # with the runner image's variables inside a composite action's `with:`, so
+    # `${{ env.ImageVersion }}` there silently expands to an empty string and the
+    # key gains a blank field instead of the image id. Verified the wrong way
+    # round in run 32787801135, whose key came out `conan-Windows--profiles/...`.
+    - name: Identify runner image
+      id: image
+      shell: bash
+      run: echo "id=${ImageVersion:-unknown}" >> "$GITHUB_OUTPUT"
+
+    - name: Cache conan packages
+      uses: actions/cache@v4
+      with:
+        path: ~/.conan2
+        key: conan-${{ runner.os }}-${{ steps.image.outputs.id }}-${{ inputs.profile }}-${{ hashFiles('conanfile.txt', 'profiles/*') }}
+
+    # Pinned below the next major: a bare `pip install conan` would float to
+    # conan 3.x and break these jobs with no change on our side.
+    - name: Install conan
+      shell: bash
+      run: pip install "conan>=2.13,<3"
+
+    # profiles/macos and profiles/linux are `include(default)`, so the default
+    # profile has to exist even though every invocation passes an explicit one.
+    # profiles/mingw is standalone and does not need it.
+    - name: Detect default profile
+      shell: bash
+      run: conan profile detect --force
+
+    - name: Resolve dependencies
+      shell: bash
+      run: |
+        conan install . --output-folder=build --build=missing \
+          -pr:h="${{ inputs.profile }}" -pr:b="${{ inputs.profile }}"