ci: fetch gcc from buildcache mirror and pin runner image

gcc was built from source (~58 min/job) because the FairMQ buildcache mirror
is only configured inside the env yaml, while gcc is installed before the env
is created.

- register the mirror globally after spack setup so "Install GCC" pulls the
  compiler as a binary
- pin runners to ubuntu-24.04 so the weekly buildcache and weekday CI share an
  image and concretize to matching hashes
- bump setup-spack to v3 to match the update-index job

.github/actions/setup-deps/action.yml

@@ -18,7 +18,7 @@ runs:
   # so we use ::group:: to make them visible.
   steps:
     - name: Setup spack
-      uses: spack/setup-spack@v2
+      uses: spack/setup-spack@v3
       with:
         ref: v1.1.0
         color: true
@@ -31,6 +31,18 @@ runs:
         spack compiler find
         echo "::endgroup::"
 
+    - name: Add FairMQ buildcache mirror
+      shell: spack-bash {0}
+      run: |
+        echo "::group::Add FairMQ buildcache mirror"
+        # Register the mirror globally (the env yamls only configure it inside the
+        # env, which is created *after* gcc is installed) so that the "Install GCC"
+        # step below can pull the compiler as a binary instead of building it from
+        # source (~58 min/job otherwise).
+        spack mirror add --unsigned --type binary \
+          ghcr-buildcache oci://ghcr.io/fairrootgroup/fairmq-spack-buildcache
+        echo "::endgroup::"
+
     - name: Install GCC
       shell: spack-bash {0}
       run: |

.github/workflows/buildcache.yml

@@ -18,7 +18,7 @@ jobs:
   build:
     if: github.repository == 'FairRootGroup/FairMQ'
     name: ${{ matrix.env }}-gcc-${{ matrix.gcc }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       packages: write
     strategy:
@@ -52,7 +52,7 @@ jobs:
   update-index:
     if: github.repository == 'FairRootGroup/FairMQ' && !cancelled()
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     permissions:

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
   build:
     if: github.repository == 'FairRootGroup/FairMQ'
     name: ${{ matrix.env }}-gcc-${{ matrix.gcc }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -56,7 +56,7 @@ jobs:
   sanitizers:
     if: github.repository == 'FairRootGroup/FairMQ'
     name: ${{ matrix.sanitizer.name }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -102,7 +102,7 @@ jobs:
   static-analysis:
     if: github.repository == 'FairRootGroup/FairMQ'
     name: static-analysis
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@v6