ci(rust): link with mold in linux cargo jobs

sccache cannot cache the link step, so test-binary linking dominated
rust-test and the packages release build. Wrap the cargo-invoking steps
with 'mold -run' (PATH-level ld interception) instead of touching
RUSTFLAGS or .cargo config, which would rekey the shared sccache cache.

.github/workflows/ci.yml

@@ -100,7 +100,7 @@ jobs:
       - name: Install system dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libsecret-1-dev
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libsecret-1-dev mold
 
       - name: Install frontend dependencies
         run: pnpm install --frozen-lockfile
@@ -157,11 +157,14 @@ jobs:
           # PR caches are large and branch-scoped; restore them from main without saving per-PR copies.
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
+      # mold -run injects itself as `ld` through PATH for the whole process
+      # tree. It must stay a wrapper: putting the linker into RUSTFLAGS or
+      # .cargo config would change every sccache key and orphan the shared cache.
       - name: Node package tests
-        run: pnpm test:packages
+        run: mold -run pnpm test:packages
 
       - name: Node package publish dry run
-        run: pnpm publish:dry-run
+        run: mold -run pnpm publish:dry-run
 
       - name: Show sccache stats
         if: always()
@@ -417,6 +420,9 @@ jobs:
           sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libsecret-1-dev
         if: matrix.group != 'foundation'
 
+      - name: Install mold linker
+        run: sudo apt-get update && sudo apt-get install -y mold
+
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@1.97.1
 
@@ -465,9 +471,11 @@ jobs:
           # PR caches are large and branch-scoped; restore them from main without saving per-PR copies.
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
+      # mold -run wraps the whole process tree (see the packages job note):
+      # test-binary linking dominates this job and sccache cannot cache links.
       - name: Cargo test
         run: |-
-          node .github/scripts/ci-rust.mjs test "$RUST_TEST_GROUP" "$RUST_FEATURE_MODE"
+          mold -run node .github/scripts/ci-rust.mjs test "$RUST_TEST_GROUP" "$RUST_FEATURE_MODE"
 
       - name: Show sccache stats
         if: always()
@@ -862,6 +870,8 @@ jobs:
       - uses: actions/checkout@v5
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@1.97.1
+      - name: Install mold linker
+        run: sudo apt-get update && sudo apt-get install -y mold
       - name: Setup sccache
         uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
         with:
@@ -900,13 +910,15 @@ jobs:
           workspaces: agents/drivers/${{ matrix.driver }} -> target
           cache-on-failure: true
           save-if: ${{ github.ref == 'refs/heads/main' }}
+      # mold -run wraps the whole process tree (see the packages job note);
+      # the duckdb sidecar links a large bundled C++ static library.
       - name: Native Rust driver tests
         env:
           DRIVER: ${{ matrix.driver }}
-        run: cargo test --manifest-path "drivers/$DRIVER/Cargo.toml" --locked
+        run: mold -run cargo test --manifest-path "drivers/$DRIVER/Cargo.toml" --locked
       - name: TDengine native agent build
         if: matrix.driver == 'tdengine'
-        run: cargo build --manifest-path drivers/tdengine/Cargo.toml --locked --release --bin dbx-tdengine-driver
+        run: mold -run cargo build --manifest-path drivers/tdengine/Cargo.toml --locked --release --bin dbx-tdengine-driver
       # Diagnostics only; agent jobs must not swallow build/test failures
       # (ci-workflow.test.mjs), so keep this step best-effort at the command level.
       - name: Show sccache stats