fix(cc): cache ordinary existing outputs

[jleni]

Summary

• cache C/C++ compiles whose existing outputs are ordinary private writable files
• atomically replace those outputs on cache hits while preserving no-clobber publication for absent paths
• keep compiler-native passthrough for symlinks, hardlinks, read-only or non-owned files, devices, and other special paths
• update the locked h2 to 0.4.16 after CI surfaced RUSTSEC-2026-0258

Root cause

The output-path safety gate added in #664 treated every existing path as requiring compiler semantics. That protected special paths such as /dev/null, but it also bypassed both cache reads and writes for normal CMake configuration rebuilds. Cache restore also only supported absent-path publication.

Safety boundary

Only owner-writable, single-link regular files may be replaced. Restore validates the complete output set and revalidates each existing target immediately before replacement. Special outputs continue to receive the selected compiler's original path semantics unchanged.

Validation

• affected C/C++ unit and integration tests pass locally
• focused cargo-mutants: 7/7 permission-admission mutants caught
• strict workspace clippy, rustfmt, and dependency audit pass locally
• exact-head CI is green across Linux, macOS, Windows, E2E, Nix, Kani, audit, and all mutation gates

Fixes #744