ci: restore binfmt cache reads in the release docker job

[nozaq]

Summary

Follow-up to #169. A log review of the runs under the new cache-mode settings found one cache user the workflow files do not show: docker/setup-qemu-action keeps the tonistiigi/binfmt image in the Actions cache by default (cache-image: true). The docker job of release.yml runs it under cache-mode: none, so the PR dry run of #169 logged

Cache restore skipped: the effective cache-mode 'none' does not permit reads.
/usr/bin/docker pull docker.io/tonistiigi/binfmt:latest
...
Cache save skipped: the effective cache-mode 'none' does not permit writes.

and pulled the image from Docker Hub instead of restoring the copy the docker job of ci.yml saves on main.

This sets cache-mode: read on that job. read is enough: the job only needs to restore the main copy, and a save from a tag ref would land in a scope no other run restores.

Verification

Job logs of the runs before and after #169 were compared for every job whose mode changed (the runner prints Cache mode: <mode> at job start):

• write jobs still restore and save as before: setup-go in ci.yml, codeql.yml and pages.yml, type=gha import/export and the binfmt cache in the ci.yml docker job.
• read jobs restore and skip the save as intended: the release build matrix and sarif-upload-check.yml.
• none jobs show no cache operation, except the one fixed here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AKZPpJJVhgvmm2GZbX3nxV

---

Generated by Claude Code