CI: add CPM source cache to avoid re-cloning numsim-cas every build

[petlenz]

Summary

`.github/workflows/build.yml` doesn't set `CPM_SOURCE_CACHE` or use `actions/cache`, so each of the 4 matrix jobs (gcc-14 + clang-18 × Debug/Release) re-clones numsim-cas on every push. Cheap fix; opens a 10-30s CI speedup per cold build.

Fix

```yaml
env:
CPM_SOURCE_CACHE: ${{ github.workspace }}/.cpm-cache

steps:

• uses: actions/checkout@v4

• uses: actions/cache@v4
  with:
  path: ${{ env.CPM_SOURCE_CACHE }}
  key: cpm-${{ runner.os }}-${{ hashFiles('CMakeLists.txt') }}
  restore-keys: cpm-${{ runner.os }}-

... existing build steps ...

```

The cache key includes the CMakeLists.txt hash so a SHA bump on the numsim-cas pin invalidates the cache automatically.

Refs

• Spun out of PR Migrate numsim-cas dependency from FetchContent to CPM.cmake #25's review (the moving-target piece of CI hygiene: pin numsim-cas, enable -Werror on tests, add UBSan/ASan job #13 fix); orthogonal to CI hygiene: pin numsim-cas, enable -Werror on tests, add UBSan/ASan job #13's other items (warnings-as-errors, sanitizers).
• Estimated effort: 5 minutes + one CI cycle to confirm.
• Severity: Low (perf only; correctness unaffected).