Cache the CI toolchain in a shared action

ci/toolchain installs the pinned tools, collections and rsync from cache for
both GitHub and Gitea; GitLab caches pip downloads. shellcheck now finds
scripts rather than globbing, which broke when a glob matched nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ci-github-actions.md

@@ -64,6 +64,15 @@ works where an inbound exception would need a policy change. Do not set the
 variable before a runner carries that label — a label no runner has leaves jobs
 queued forever rather than failing.
 
+A self-hosted runner needs Python's `venv` module and, for deploys, either rsync
+or `apt-get` with sudo: the toolchain action installs rsync when it is missing,
+because `synchronize` runs it on the runner as well as on the host.
+
+The toolchain itself comes from `ci/toolchain/`, a composite action shared with
+the Gitea workflows. It caches a venv and the Galaxy collections with
+`actions/cache`, keyed on the pins in `scripts/check.sh` and
+`ansible/requirements.yml` and on the month, so most runs install nothing.
+
 ## Deploying
 
 Actions → **deploy** → Run workflow. Three fields: