[chore](trx-rs): allow the sccache bind mount on the CI runner

act_runner validates every bind mount against `valid_volumes`, which
defaults to an empty allowlist, so the `-v /var/cache/sccache:/sccache`
in `container.options` was dropped on every job.  The only trace is one
line in the job log — "[/var/cache/sccache] is not a valid volume, will
be ignored" — after which SCCACHE_DIR points at a path that does not
outlive the container, so the shared compilation cache never persisted.

Allow that one path rather than the `**` wildcard: the runner is the only
thing mounting host directories here, and a narrow allowlist keeps a
workflow from mounting arbitrary host paths into a job container.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GdyUjuXejCEfiub675z6cz
Signed-off-by: Stan Grams <sjg@haxx.space>

container/runner-config.example.yaml

@@ -31,6 +31,12 @@ container:
   # host (create it first: `mkdir -p /var/cache/sccache`), matching SCCACHE_DIR
   # in the workflow.
   options: "--cpus=2 -v /var/cache/sccache:/sccache"
+  # act_runner rejects every bind mount unless it is listed here — the default
+  # is an empty allowlist, so the -v above is dropped with only a
+  # "[...] is not a valid volume, will be ignored" line in the job log, and
+  # SCCACHE_DIR then points at a directory that does not outlive the job.
+  valid_volumes:
+    - /var/cache/sccache
   # Reuse the host VM's Docker network for the built-in cache/artifact server.
   network: "host"
   # The workflow pulls the SDK image by the moving `:latest` tag. Without this