CI: cut repeated work in the C++ builds

[Gin890]

Why

A push to main uses about 240 runner-minutes, and the slowest job (Ubuntu clang) takes 72–89 minutes. Per-step timings from recent runs show that most of this is the same work repeated on every run:

Job	Total	Where the time goes
Ubuntu clang	72–89 min	clang-query 42–55 min, build 23–29 min
Mac Intel	49–51 min	brew 16–18 min (13 of it compiling libdpp), build 18–24 min
Ubuntu Default	41 min	clang-query 26–28 min, build 10–11 min
Windows ×2	22–32 min each	build 19–27 min
Mac	21–22 min	build 11–13 min, brew 5–7 min (4 of it compiling libdpp)

Changes

• clang-query runs in one job, one batch per core. It checks the source rather than the compiled code, so running it in both Ubuntu jobs was redundant. It now runs only in Ubuntu Default, the fastest Linux build. It runs nproc batches of 10 files at once, each batch writing to its own output file. Each file is now listed only once: compile_commands.json has one entry per target for files built into several targets, and clang-query already checks every entry of each file it's given, so a file listed twice had each of its entries parsed twice. If clang-query fails on a file, the step still prints the collected output and then fails.
• libdpp is cached on macOS. Our pinned brew formula has no bottle, so every Mac job compiled DPP from source. The installed keg is now cached with actions/cache, keyed on the formula file and on the installed versions of libsodium, openssl@3 and opus, so a Homebrew update to any of them triggers a rebuild. A new pkg-config --exact-version=10.1.5 dpp check fails the job if DPP isn't found. Without it, CMake would build without Discord integration and the job would pass.
• ccache on Linux and macOS via hendrikmuhs/ccache-action. Only pushes to main save the cache; PRs restore main's latest one, so PR runs don't use up the repo's 10 GB cache quota. evict-old-files: job keeps each saved cache to what that build used. Windows isn't covered because ccache can't cache MSVC builds that use /Zi (PDB debug info); that would need /Z7.
• Qt is cached (cache: true on install-qt-action) instead of being downloaded in every job.
• tabs.yml runs on pushes to main only. It ran on pushes to every branch as well as on pull_request, so it ran twice for each PR push.

Expected effect

• Ubuntu clang should drop to about 30 minutes and Ubuntu Default to about 20, even before ccache. The slowest job would then be Mac Intel, at about 35 minutes once libdpp is cached.
• The caches start out empty: this PR's own run populates the Qt and libdpp caches, and the first push to main after merge populates ccache. The ccache savings show up from the following runs.

Testing

• I tested the new clang-query script with GNU xargs on Linux, using a stub clang-query and a real compile_commands.json (1,545 entries, 1,419 unique files). Every file was checked exactly once, and a path containing a space worked. A match fails with the existing "Forbidden code" error, and a clang-query error fails with the new message after printing the output.
• All workflow files parse.
• CI passes on this PR (libdpp and Qt caches populated)
• After merge: the second push to main shows ccache hits in the job summary and a cache-hit restore for libdpp

🤖 Generated with Claude Code