Backlog: F6b3 done (oxygen CI about 285 s to 139 s) b0abd4a74708

- [x] F6a Runner runs several jobs at once within a budget (Earth: 3 jobs, 24 GiB, 8 vCPUs); the hub hands out only jobs that fit the room the runner reports.

- [x] F6b1 Faster Rust jobs, first part: CI builds without debug info or incremental state, set once in each pipeline's rust sandbox env.

- [x] F6b2 A warm dependency cache: the dependencies of each lock file prebuilt in the build image and copied onto the job's scratch disk; measured on oxygenhub.

- [x] F5 Required checks: each repository's default bookmark requires its pipeline's checks to land, and the work loop pushes and waits for green instead of gating only locally.

- [x] O10e Checkpoint payload version 2: large file graphs as shared blobs named from an index, read and decoded in parallel; readers accept both versions (spec §11). Agreed by Andy on 2026-09-28.

- [x] M1 (metalgear feedback 1, reported by Andy) Bookmarks with `/` in their names could not be pushed: attestation and checkpoint files are now flat, escaped names (oxygen#12). The hub is pinned to the fix and deployed.

    Only the five workspace crates compile, and clippy compiles none.

  - **Andy:** rebuild the image when a Cargo.lock moves (`images/rust/build.sh`). Until then only the changed crates compile.

  - I ran `git --version` once by mistake while checking a pipeline. It touched no repository.