Cache the CI toolchain in a shared action

ci/toolchain installs the pinned tools, collections and rsync from cache for
both GitHub and Gitea; GitLab caches pip downloads. shellcheck now finds
scripts rather than globbing, which broke when a glob matched nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -80,10 +80,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-
       # STACK, MODE and PULL reach a shell command, and under repository_dispatch
       # they come from another repository. They go through the environment, never
       # through ${{ }} interpolation into a run: block — an expression is
@@ -122,11 +118,13 @@ jobs:
             echo "PULL=$PULL"
           } >> "$GITHUB_ENV"
 
+      # rsync too: ansible.posix.synchronize shells out to it on the machine
+      # Ansible runs on, not only on the target.
       - name: Install the pinned toolchain
-        run: |
-          set -eu
-          scripts/check.sh --print-specs | head -1 | xargs -d '\n' pip install --quiet
-          ansible-galaxy install -r ansible/requirements.yml
+        uses: ./ci/toolchain
+        with:
+          collections: "true"
+          rsync: "true"
 
       # Two lines, not `export SSH_KEY_PATH="$(...)"`. export is a special
       # builtin, so the compound command reports *its* exit status and swallows