fix(ci): use SEA binary cache from build-sea.yml in publish-socketbin.yml

Ensure publish-socketbin.yml workflow reuses the same cache keys and
artifacts that build-sea.yml produces to avoid unnecessary rebuilds.

Changes:
- Add build-deps cache restoration matching build-sea.yml key generation
- Add SEA binary cache restoration with same key pattern as build-sea.yml
- Only build bootstrap/socket packages if deps cache miss
- Only build CLI and SEA binary if SEA cache miss
- Use cross-platform compatible hash commands (sha256sum/shasum)

This enables efficient cache reuse between build and publish workflows.

Author: jdalton

.github/workflows/publish-socketbin.yml

@@ -150,14 +150,72 @@ jobs:
             --arch=${{ matrix.arch }} \
             --clean
 
-      - name: Build CLI (required for SEA)
+      - name: Generate build-deps cache key
         if: inputs.method == 'sea' || inputs.method == 'smol-sea'
+        id: deps-cache-key
+        shell: bash
+        run: |
+          # Include pnpm-lock.yaml to detect dependency changes (matches build-sea.yml).
+          if [ "${{ matrix.os }}" = "windows" ]; then
+            HASH=$(find packages/bootstrap packages/socket -type f \( -name "*.mts" -o -name "*.ts" -o -name "*.mjs" -o -name "*.js" -o -name "*.json" \) ! -path "*/node_modules/*" ! -path "*/dist/*" ! -path "*/build/*" | sort | xargs sha256sum | sha256sum | cut -d' ' -f1)
+            LOCK_HASH=$(sha256sum pnpm-lock.yaml | cut -d' ' -f1)
+          else
+            HASH=$(find packages/bootstrap packages/socket -type f \( -name "*.mts" -o -name "*.ts" -o -name "*.mjs" -o -name "*.js" -o -name "*.json" \) ! -path "*/node_modules/*" ! -path "*/dist/*" ! -path "*/build/*" | sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)
+            LOCK_HASH=$(shasum -a 256 pnpm-lock.yaml | cut -d' ' -f1)
+          fi
+          COMBINED_HASH=$(echo "$HASH-$LOCK_HASH" | sha256sum | cut -d' ' -f1 || echo "$HASH-$LOCK_HASH" | shasum -a 256 | cut -d' ' -f1)
+          echo "deps-hash=$COMBINED_HASH" >> $GITHUB_OUTPUT
+
+      - name: Restore build-deps cache
+        if: inputs.method == 'sea' || inputs.method == 'smol-sea'
+        id: deps-cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            packages/bootstrap/dist/
+            packages/socket/dist/
+          key: build-deps-sea-${{ steps.deps-cache-key.outputs.deps-hash }}
+          restore-keys: build-deps-sea-
+
+      - name: Build bootstrap package
+        if: (inputs.method == 'sea' || inputs.method == 'smol-sea') && steps.deps-cache.outputs.cache-hit != 'true'
+        run: pnpm --filter @socketsecurity/bootstrap run build
+
+      - name: Build socket package bootstrap
+        if: (inputs.method == 'sea' || inputs.method == 'smol-sea') && steps.deps-cache.outputs.cache-hit != 'true'
+        run: pnpm --filter socket run build
+
+      - name: Generate SEA build cache key
+        if: inputs.method == 'sea' || inputs.method == 'smol-sea'
+        id: sea-cache-key
+        shell: bash
+        run: |
+          if [ "${{ matrix.os }}" = "windows" ]; then
+            SEA_HASH=$(find packages/node-sea-builder packages/cli/src -type f \( -name "*.mts" -o -name "*.ts" -o -name "*.mjs" -o -name "*.js" \) | sort | xargs sha256sum | sha256sum | cut -d' ' -f1)
+          else
+            SEA_HASH=$(find packages/node-sea-builder packages/cli/src -type f \( -name "*.mts" -o -name "*.ts" -o -name "*.mjs" -o -name "*.js" \) | sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)
+          fi
+          # Include bootstrap/socket/cli dependencies in cache key (matches build-sea.yml).
+          COMBINED_HASH=$(echo "$SEA_HASH-${{ steps.deps-cache-key.outputs.deps-hash }}" | sha256sum | cut -d' ' -f1 || echo "$SEA_HASH-${{ steps.deps-cache-key.outputs.deps-hash }}" | shasum -a 256 | cut -d' ' -f1)
+          echo "hash=$COMBINED_HASH" >> $GITHUB_OUTPUT
+
+      - name: Restore SEA binary cache
+        if: inputs.method == 'sea' || inputs.method == 'smol-sea'
+        id: sea-cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: packages/node-sea-builder/dist/sea/
+          key: node-sea-${{ matrix.platform }}-${{ matrix.arch }}-${{ steps.sea-cache-key.outputs.hash }}
+          restore-keys: node-sea-${{ matrix.platform }}-${{ matrix.arch }}-
+
+      - name: Build CLI (required for SEA)
+        if: (inputs.method == 'sea' || inputs.method == 'smol-sea') && steps.sea-cache.outputs.cache-hit != 'true'
         shell: bash
         run: pnpm --filter @socketsecurity/cli run build
 
       - name: Build SEA binary
         id: build-sea
-        if: inputs.method == 'sea' || inputs.method == 'smol-sea'
+        if: (inputs.method == 'sea' || inputs.method == 'smol-sea') && steps.sea-cache.outputs.cache-hit != 'true'
         shell: bash
         run: |
           echo "Building SEA binary..."