Compressed cache artifacts and configurable output symlink capture

Cache artifacts are now compressed with zstd before being stored in the local content-addressable storage, saving disk space while keeping BLAKE3 digests based on the uncompressed bytes for compatibility with existing raw blobs. Cache entries also support a new # once output-symlinks annotation: by default, cached directory outputs are restored with external symlinks materialized as real files, and scripts can opt into preserving the original symlinks with preserve. This change also removes the separate # once script annotation parsing (scripts now use # Once annotations) and reserves once.toml for workspace configuration.