Share one dependency cache across CI jobs

[cristianrgreco]

Stacked on #1496, which is stacked on #1495 and #1492. Review and merge those first.

Summary

Every job that installs dependencies now restores one shared cache per Node version, instead of one cache per package.

• npm-setup loses its workspace input and workspace_path output. It always runs npm ci for every workspace, with one cache key per runner, Node version and lockfile.
• test-template.yml works out the path of the package under test itself.
• The smoke tests use the shared cache too. Their steps are otherwise unchanged.

Why

	Per-package caches (now)	Shared cache (this PR)
Entries	97	2 (Node 22.x and 24.x)
Storage	6.4 GB	about 0.9 GB
Size restored per job	56 MB median, 344 MB largest	449 MB

The repository is over GitHub's 10 GB Actions cache limit (10.8 GB), so caches are being evicted and jobs fall back to npm ci. On the last all-green run, the install step in the 176 test jobs took 7s at the median and up to 32s.

Trade-offs

• About 4s more per job on a cache hit. Restoring the shared cache took 11s in the Knip job, against the 7s median today. Across 176 test jobs that's roughly 12 more runner-minutes per full run, on top of about 190.
• Test jobs no longer run with only their own module's dependencies installed. That isolation could catch a module importing a package that only another module declares. Knip (Detect unused code and dependencies with knip #1492) now reports undeclared imports for every workspace, and Declare missing module dependencies #1485 adds the equivalent Biome rule.
• The smoke tests' prune step sees more installed packages. npm prune --omit=dev --workspace packages/testcontainers removes the same 11 packages after either install (336 to 325 with a testcontainers-only install, 1126 to 1115 with a full one). The one case that's weaker: a package testcontainers needs at runtime but lists only as a dev dependency now goes unnoticed if any module also depends on it, where before only the root counted. The step never gave a production-only environment: vitest, TypeScript and Biome stay installed after it either way.
• First run after a lockfile change: the jobs for a Node version all miss at once and each runs npm ci (35s on CI) until one saves the cache. Today every job also misses on a lockfile change, since each per-package key includes the lockfile hash.

Verification

• The cache key and path list are the ones the full-install mode already used on CI in Detect unused code and dependencies with knip #1492's Knip job, where the first run missed and saved the cache and the next run restored it.
• The smoke tests' prune step was run locally after both kinds of install, with the results above.
• action.yml, checks.yml and test-template.yml parse. npm run format: no fixes applied.
• Not run: the new TEST_PATH expression in test-template.yml, which GitHub evaluates. It yields packages/testcontainers for testcontainers and packages/modules/<name> otherwise, the same paths the action returned before.
• Not verified: the Checks workflow only runs for PRs that target main, so it won't run on this PR until the PRs below it merge and this one is retargeted. The cache figures above are from the existing caches and from the shared cache that Detect unused code and dependencies with knip #1492's Knip job created.

Why this isn't breaking

CI-only. No package source, dependency or published file changes.