feat(darwin): add kache build cache with R2 remote

Wire the kunobi-ninja/kache darwin module into the flake: global
RUSTC_WRAPPER, /etc/kache/config.toml pointing at the kache-build-cache
R2 bucket, and a launchd daemon whose wrapper loads sops-decrypted
KACHE_S3_* credentials at runtime (launchd does not inherit the shell
environment). Ignore the cf CLI's local cache dir.

flake.nix

@@ -24,6 +24,9 @@
 
     try.url = "github:tobi/try";
     try.inputs.nixpkgs.follows = "nixpkgs";
+
+    # Rust/C++ build cache (RUSTC_WRAPPER + launchd daemon, backed by R2)
+    kache.url = "github:kunobi-ninja/kache";
   };
 
   outputs =
@@ -37,6 +40,7 @@
       sops-nix,
       chaotic,
       try,
+      kache,
       ...
     }:
     let
@@ -58,7 +62,11 @@
       # No overlays needed for Darwin builds
       # - gitOverlay: removed - was causing mypy to rebuild from source
       # - chaotic: removed - only needed for NixOS, was causing nix to rebuild with failing tests
-      overlaysList = [ ];
+      # kache overlay (includes rust-overlay) so pkgs.kache builds with the
+      # toolchain pinned in kache's rust-toolchain.toml
+      overlaysList = [
+        kache.overlays.default
+      ];
 
       mkPkgs =
         system:
@@ -68,7 +76,10 @@
           config.allowUnfree = true;
         };
 
-      sharedDarwinModules = [ ./modules/darwin/system.nix ];
+      sharedDarwinModules = [
+        ./modules/darwin/system.nix
+        ./modules/darwin/kache.nix
+      ];
       sharedNixosModules = [
         ./modules/nixos/system.nix
         chaotic.nixosModules.default