ci: constrain benchmark cache access

.github/workflows/cache-key-stability.yml

@@ -47,6 +47,7 @@ jobs:
   probe:
     name: ${{ matrix.platform }} / replica ${{ matrix.replica }}
     runs-on: ${{ matrix.os }}
+    cache-mode: none
     timeout-minutes: 20
     strategy:
       fail-fast: false

.github/workflows/cache-save.yml

@@ -76,6 +76,7 @@ jobs:
   measure:
     name: paired / ${{ matrix.sample }}
     runs-on: ubuntu-24.04
+    cache-mode: write-only
     # At this fixture size a normal save is seconds, not minutes. A slot that has
     # not returned after three minutes is a cache-service stall; the report can
     # discard the incomplete runner instead of letting the workflow wait for the

.github/workflows/cache-value.yml

@@ -69,6 +69,7 @@ jobs:
   seed:
     name: Seed cache
     runs-on: ubuntu-24.04
+    cache-mode: write-only
     steps:
       - name: Check out benchmark repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -108,6 +109,7 @@ jobs:
     name: paired / ${{ matrix.sample }}
     needs: seed
     runs-on: ubuntu-24.04
+    cache-mode: read
     # The uncached arm downloads PetClinic's whole dependency tree from Maven
     # Central twice per runner, which is the slowest thing this repository does.
     timeout-minutes: 40

.github/workflows/jdk-cache.yml

@@ -114,6 +114,7 @@ jobs:
     name: Seed caches
     needs: prepare
     runs-on: ubuntu-24.04
+    cache-mode: write-only
     steps:
       - name: Check out benchmark repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -161,6 +162,7 @@ jobs:
     name: paired / ${{ matrix.sample }}
     needs: seed
     runs-on: ubuntu-24.04
+    cache-mode: read
     # A measurement job is a couple of minutes of work. Anything far beyond that
     # is a stalled cache download or JDK fetch rather than a slow measurement,
     # and the run should not wait six hours for the default timeout to notice.