Wrap CC and CXX with sccache by default

Build scripts that compile C/C++ (cc crate, libduckdb-sys's bundled
DuckDB, ring's assembly) are not cached by RUSTC_WRAPPER and dominate
warm CI time on Rust projects with heavy native deps. Export
CC=sccache cc and CXX=sccache c++ so those compilations land in the
same sccache backend as rustc.

Gated behind a new sccache-wrap-cc input (default "true") so callers
with build systems that do not tolerate multi-word CC/CXX can opt out.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -61,6 +61,7 @@ Omit `sccache-bucket` to use the runner-local sccache cache:
 - `sccache-s3-use-ssl`: Whether the endpoint uses TLS. Defaults to `"true"`.
 - `sccache-s3-enable-virtual-host-style`: Set to `"true"` only for endpoints that require virtual-host-style addressing.
 - `sccache-key-prefix`: Optional cache key prefix. Defaults to repository, runner, and toolchain scope.
+- `sccache-wrap-cc`: Wrap `CC` and `CXX` with sccache so build-script C/C++ compiles (e.g. `libduckdb-sys`, `ring`) hit the cache too. Defaults to `"true"`. Set to `"false"` to opt out.
 
 ### Notes
 
@@ -68,6 +69,10 @@ Omit `sccache-bucket` to use the runner-local sccache cache:
   variables from workflow secrets.
 - `CARGO_INCREMENTAL=0` is set because Rust incremental artifacts are not a
   good fit for sccache-backed CI builds.
+- When `sccache-wrap-cc` is enabled, `CC` is exported as `sccache cc` and `CXX`
+  as `sccache c++`. The `cc` crate splits on whitespace, so build scripts that
+  go through it pick up the wrapper transparently. Build systems that do not
+  support multi-word `CC`/`CXX` should opt out.
 - `SCCACHE_IGNORE_SERVER_IO_ERROR=1` is set so a cache outage falls back to
   local compilation instead of failing the build.
 - `SCCACHE_IDLE_TIMEOUT=3600` keeps the server alive across long build/test