ci: build kona-zkvm-canary in its own melange stack

[geoknee]

Why

kona-zkvm-canary was a subpackage of melange/op-stack-rust.yaml. Its SP1 profiling feature has to stay out of the combined build, so it already ran its own cargo build with its own target tree (rust_kona_sp1_crates_zkvm-canary). It shared nothing with the main build, but melange runs subpackage pipelines after the main pipeline. So every op-stack-rust leg paid for two fat-LTO builds back to back.

Develop run 37809128424:

leg	main 6-binary build	canary build (after it)	job total
aarch64	24m47s	22m42s	50m
x86_64	18m04s	14m09s	35m

Every image built from op-stack-rust waited for it, including kona-node/v*, kona-host/v* and kona-client/v* release tags.

Change

• New melange/kona-zkvm-canary.yaml, the same build step moved verbatim: same build environment, install-dir, modroot, profile and strip.
• The kona-zkvm-canary subpackage is removed from op-stack-rust.yaml.
• In images.apko.json, a new kona-zkvm-canary melange stack (large runner, GHA cache keyed on rust/Cargo.lock), and the canary image now needs_melange: ["kona-zkvm-canary"].

The factory apko-plan script (pinned sha b71bfb2), run locally against this catalog, gives:

• develop push: separate kona-zkvm-canary/{x86_64,aarch64} legs. kona-node, kona-host, kona-client and op-challenger still depend on op-stack-rust only.
• kona-node/v1.8.0-rc.3 tag: melange builds only op-stack-rust, with no canary.
• kona-zkvm-canary/v0.2.0 tag: only the canary stack, with build_version=v0.2.0.

Expected effect

• Develop: about 50m → about 25m on aarch64 and 35m → 18m on x86 for the melange stage. The apko job still waits for the whole melange matrix, so the canary leg runs in parallel rather than vanishing.
• op-stack-rust release tags skip the canary entirely.
• Cost: two more large runner jobs per rust build. The canary's target tree moves out of the op-stack-rust cache into its own cache entry; CARGO_HOME is now duplicated across the two.

Caveats for review

• The first develop run after merge is cold for the canary leg. It gets a new cache key, so expect one full maxperf build of kona-host + SP1. The op-stack-rust cache still restores, minus the canary tree it no longer needs.
• This PR edits .github/images.apko.json, a shared_paths entry, so CI here plans the full catalog. That exercises the new stack end to end on fast-build.
• Independent of fix: key melange cache by cargo profile factory#68 (cache key by cargo profile). Each helps on its own.

🤖 Generated with Claude Code