模板 v2：script 模式与通用件

- oci：build-command 脚本模式（install+build 同容器；全套挂载
  sock/docker-config/buildx/CA/cache；commit-env-name 注入；extra-env；
  digest summary 复用 image-matrix；image-matrix 改可选）
- 两模板：cache-mode fixed|per-run（per-run = mktemp 子目录 + always()
  清理，满足 from-zero 工具缓存契约）、mount-docker-socket、commit-env-name
- 呼应 P1-9：中性变量注入由模板承担（EST_GIT_COMMIT 等）

.gitea/workflows/reusable/node-quality.yml

@@ -44,7 +44,27 @@ on:
         required: false
         type: string
         default: /data/cache/ci/quality
-        description: "Persistent host-side cache dir (pnpm store, tools, browsers)"
+        description: "Host-side cache dir (pnpm store, tools, browsers)"
+      cache-mode:
+        required: false
+        type: string
+        default: fixed
+        description: "fixed: one shared persistent dir. per-run: fresh mktemp child per run + always() cleanup (for scripts with from-zero guards on commit-keyed tool caches)"
+      mount-docker-socket:
+        required: false
+        type: boolean
+        default: false
+        description: "Mount /var/run/docker.sock into the toolchain containers (install scripts that pull images)"
+      commit-env-name:
+        required: false
+        type: string
+        default: ""
+        description: "Env var name that receives the triggering commit SHA inside the containers (e.g. EST_GIT_COMMIT); empty disables"
+      extra-env:
+        required: false
+        type: string
+        default: ""
+        description: "Multiline KEY=VALUE extra env for the toolchain containers (values must not contain spaces; caller-side expressions are NOT evaluated)"
     secrets:
       REGISTRY_PASSWORD:
         required: false
@@ -80,21 +100,51 @@ jobs:
       - name: prepare cache dir (dirs 0777, files untouched)
         run: |
           set -eu
-          mkdir -p "${{ inputs.cache-dir }}"
-          chmod 0777 "${{ inputs.cache-dir }}"
-          find "${{ inputs.cache-dir }}" -mindepth 1 -maxdepth 1 -type d -exec chmod 0777 {} + 2>/dev/null || true
+          cache_root="${{ inputs.cache-dir }}"
+          mkdir -p "$cache_root"
+          chmod 0777 "$cache_root"
+          if [ "${{ inputs.cache-mode }}" = "per-run" ]; then
+            cache_dir="$(mktemp -d "$cache_root/run-XXXXXXXX")"
+          else
+            cache_dir="$cache_root"
+          fi
+          chmod 0777 "$cache_dir"
+          find "$cache_dir" -mindepth 1 -maxdepth 1 -type d -exec chmod 0777 {} + 2>/dev/null || true
+          printf 'TOOL_CACHE_DIR=%s\n' "$cache_dir" >>"$GITHUB_ENV"
 
       # install and quality run in ONE container: toolchains installed by the
       # install command (global pnpm, local bins) must still be on PATH for the
       # quality command — two `docker run --rm` invocations would not share
       # anything but the workspace and /cache mounts.
       - name: install and quality (containerized toolchain)
+        env:
+          COMMIT_ENV_NAME: ${{ inputs.commit-env-name }}
         run: |
           set -eu
+          mount_args=""
+          if [ "${{ inputs.mount-docker-socket }}" = "true" ]; then
+            mount_args="-v /var/run/docker.sock:/var/run/docker.sock"
+          fi
+          env_args=""
+          if [ -n "${COMMIT_ENV_NAME}" ]; then
+            env_args="${env_args} -e ${COMMIT_ENV_NAME}=${GITHUB_SHA}"
+          fi
+          while IFS= read -r line; do
+            [ -n "$line" ] && env_args="${env_args} -e $line"
+          done <<EOF
+          ${{ inputs.extra-env }}
+          EOF
+          # shellcheck disable=SC2086
           docker run --rm --add-host npm.cache.est:172.17.0.1 \
+            $mount_args \
             -v "$PWD:${{ inputs.workspace }}" -w "${{ inputs.workspace }}" \
-            -v "${{ inputs.cache-dir }}:/cache" -e TMPDIR=/cache \
+            -v "${TOOL_CACHE_DIR}:/cache" -e TMPDIR=/cache \
             -v /usr/local/share/ca-certificates/est-bundle.crt:/ca/est-bundle.crt:ro \
             -e SSL_CERT_FILE=/ca/est-bundle.crt \
             -e NODE_EXTRA_CA_CERTS=/ca/est-bundle.crt \
+            $env_args \
             "${{ inputs.node-image }}" sh -euxc '${{ inputs.install-command }} && ${{ inputs.quality-command }}'
+
+      - name: cleanup per-run cache dir
+        if: always() && inputs.cache-mode == 'per-run'
+        run: rm -rf -- "${TOOL_CACHE_DIR:-}"