CI: run once per PR, and stop PR caches from evicting the `main` cache (#8507)

The `Run tests` job takes 9-12 minutes because it finds no cargo cache
and rebuilds all 390 crates; the last run that hit the cache took 4m20s
for the whole job. The repository holds 30 caches totalling 10.6 GB,
over the 10 GB limit, so entries are evicted constantly. Each PR saves
its own ~2.5 GB copy of every job cache, which pushes out the `main`
cache that every new PR starts from.

* `on: [push, pull_request]` ran the whole workflow twice for a PR from
a branch in this repo, doubling both runner time and cache writes. The
push half now only runs for `main`.
* Only `main` writes to the cargo cache (`save-if`). PRs still read it.
* New workflow deletes the caches of a PR when it is closed.

* [x] I have followed the instructions in the PR template

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>