fix(ci): make Vagrant box cache version-aware

- key immutable caches from a pinned box manifest instead of scenario YAML
- skip producer restoration and downloads on exact cache hits
- validate lock drift, exact versions, architectures, and missing boxes

.github/vagrant-boxes.lock

@@ -0,0 +1,4 @@
+# box version architecture
+generic/debian12 4.3.12 amd64
+generic/rocky9 4.3.12 amd64
+generic/ubuntu2204 4.3.12 amd64