ci: restore caches before cargo install espflash

`cargo install espflash --locked` builds from source. Moving the
.embuild + Swatinem cargo-cache restores ahead of it lets the install
use the cached registry index + downloaded crates instead of fetching
them fresh each run — shaves ~30 s off the install on warm caches.

Pure step-reordering; no behavioural change. Both caches still depend
on inputs that exist at checkout, so an earlier restore is safe.

Bigger speedup is available by replacing the cargo install with a
prebuilt-binary install (e.g. taiki-e/install-action drops espflash
from ~3-5 min to ~2 s). Deferred to its own PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/publish.yml

@@ -47,16 +47,10 @@ jobs:
           buildtargets: esp32
           ldproxy: true
 
-      - name: Install espflash
-        run: cargo install espflash --locked
-
-      - name: Install cosign
-        # cosign-installer doesn't publish a moving v4 tag, only specific
-        # patch versions. Pin to the latest v4.x. (v4 installs cosign 3
-        # by default, which produces the Sigstore Bundle v0.3 format
-        # the on-device verifier in src/sig.rs parses.)
-        uses: sigstore/cosign-installer@v4.1.1
-
+      # Restore caches *before* `cargo install espflash` so it benefits
+      # from the cached cargo registry (saves the ~30s of crates-io
+      # index sync + dep download). The .embuild cache also primes
+      # earlier — same restore time, just less time-to-build at the end.
       - name: Cache .embuild (ESP-IDF + tools)
         uses: actions/cache@v5
         with:
@@ -73,6 +67,16 @@ jobs:
             tools/publisher
           shared-key: publish
 
+      - name: Install espflash
+        run: cargo install espflash --locked
+
+      - name: Install cosign
+        # cosign-installer doesn't publish a moving v4 tag, only specific
+        # patch versions. Pin to the latest v4.x. (v4 installs cosign 3
+        # by default, which produces the Sigstore Bundle v0.3 format
+        # the on-device verifier in src/sig.rs parses.)
+        uses: sigstore/cosign-installer@v4.1.1
+
       - name: Write gh.env from GITHUB_TOKEN
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}