feat(cache-maintenance): usable in non-score setups

[AlexanderLanin]

fixes and docs developed during attempt to apply the cache workflows

[Copilot]

Pull request overview

Adds cache workflow fixes, credential compatibility, and integration documentation.

Changes:

• Adds private-dependency and updated QNX credential support.
• Documents cache integration and lifecycle behavior.
• Links the new guide from the README.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
README.md	Links the cache-maintenance guide.
.github/workflows/cache-maintenance.yml	Updates cache behavior and credentials.
.github/workflows/cache-maintenance.md	Adds integration and operations guidance.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[lurtz]

The intention of these conditions is that on pull_requests they always need to be executed for checking input variants. On push events they will only be executed, when MODULE.bazel.lock has changed.

If start to wonder if this condition should be better rewritten like this:

Suggested change

	if: ${{ steps.check.outputs.any_changed == 'true' || (github.event_name != 'push' && github.event_name != 'workflow_dispatch') }}
	if: ${{ steps.check.outputs.any_changed == 'true' || (github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}

IMHO it is better to understand when this step is actually run. On the other hand we have to cover this way all event types, which should do dry-runs. Your way is all event types, which should not do dry-runs.

If we decide to act on this all conditions should be changed accordingly.