fix(ci): guard win7 webview2 loader link against sccache

v0.6.0 shipped a win7/Server 2012 R2 installer whose dbx.exe statically
linked a WebView2 loader >= 1.0.1054.31 instead of the pinned 1.0.902.49,
failing on kernel 6.3 with ERROR_NOT_SUPPORTED. The loader patch rewrites
a file inside the cargo registry, which no compile cache can observe, so
the win7 release job stops using sccache until the loader is vendored,
and a binary audit now rejects any dbx.exe carrying post-1.0.902.49
loader strings.

.github/workflows/ci.yml

@@ -258,6 +258,10 @@ jobs:
         shell: pwsh
         run: ./.github/scripts/assert-win7-pe-compat.ps1 -BinaryPath target/x86_64-win7-windows-msvc/release/dbx.exe
 
+      - name: Audit Win7 WebView2 loader markers
+        shell: pwsh
+        run: ./.github/scripts/assert-webview2-win7-loader.ps1 -BinaryPath target/x86_64-win7-windows-msvc/release/dbx.exe
+
       - name: Bundle Windows 7 fixed-runtime installer
         shell: pwsh
         run: |
@@ -698,6 +702,7 @@ jobs:
               - '.github/workflows/update-nix-pnpm-hash.yml'
             windows_win7_bundle:
               - '.github/scripts/assert-win7-pe-compat.ps1'
+              - '.github/scripts/assert-webview2-win7-loader.ps1'
               - '.github/scripts/assert-win7-installer-content.ps1'
               - '.github/scripts/assert-webview2-win7-runtime.ps1'
               - '.github/scripts/prepare-webview2-win7-loader.ps1'