Cache action commands accept declarative input specs

cache action get and cache action put now accept a repeatable --input <spec> flag in place of, or alongside, a positional digest. The grammar covers <path> (file or sorted directory walk), path:<path> for paths containing colons, value:<str> for literal strings, env:<NAME> for the host environment, and stdin at most once. Directory walks are deterministic so the same tree always hashes the same regardless of filesystem iteration order. In addition, cache action get --if-success exits 0 only when the cache has a hit AND the recorded exit code is 0, so wrapping scripts can re-run on a cached failure without parsing the result.