Add sandbox crate + workflow to test ephemeral podman runners

.gitea/workflows/sandbox.yml

@@ -0,0 +1,39 @@
+name: Sandbox - ephemeral runner + shared cache
+on:
+  push:
+    branches: [ci/sandbox]
+  workflow_dispatch:
+
+jobs:
+  cargo:
+    runs-on: sandbox
+    defaults:
+      run:
+        working-directory: sandbox
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Where am I?
+        run: |
+          echo "runner : ${RUNNER_NAME}"
+          echo "os     : $(grep PRETTY_NAME /etc/os-release | cut -d'"' -f2)"
+          echo "uid    : $(id -u)  cgroup: $(head -c 40 /proc/self/cgroup)"
+          command -v git >/dev/null && echo "git    : $(git --version)"
+
+      - name: Toolchain
+        run: |
+          command -v cargo >/dev/null || { apt-get update -qq && apt-get install -y -qq --no-install-recommends rustc cargo >/dev/null; }
+          cargo --version
+
+      - name: Cache cargo deps and target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            sandbox/target
+          key: cargo-${{ hashFiles('sandbox/Cargo.lock') }}
+          restore-keys: cargo-
+
+      - name: Test
+        run: cargo test 2>&1 | tail -6