ci: prepare for ubuntu-latest moving to Ubuntu 26 on 2026-10-19, and fix the Lychee cache and link check #712

Problem

Three CI facts in this repository need attention, one with a date:

1. ubuntu-latest moves to Ubuntu 26 from 2026-10-19. Every job annotation carries the runner notice ("The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026", [Ubuntu] ubuntu-latest label will use Ubuntu 26.04 in November 2026 actions/runner-images#14748). 20 workflow files here use ubuntu-latest, and the reusable workflows other repositories call run on it too, so a tool or package that changes with the image breaks callers across the organization at once.
2. The Lychee cache is never saved. lychee.yml grants the job contents: read only, and "📥 Save cache" (actions/cache/save) ends with the warning "Cache save failed" on every run. Each run restores the last saved cache, finds it older than the configured one-day maximum ("Cache is too old ... Discarding and recreating"), and checks every link again.
3. The scheduled link check failed on 2026-10-01 (run 36933717011): one error, [403] https://opensource.org/licenses/ | Network error: Forbidden. The runs on 2026-09-29 and 2026-09-30 passed, so this looks like the site refusing the runner, not a broken link.

Proposed change

• Before 2026-10-19: run the reusable workflows and this repository's own checks on ubuntu-26.04 (or the preview label the runner-images issue names), list what differs, and pin ubuntu-24.04 where a job cannot move yet.
• Give the Lychee job the permission actions/cache/save needs, or drop the save step and the cache if it is not wanted.
• Decide how the link check treats sites that refuse automated clients (an accept or exclude entry for opensource.org in .github/lychee.toml, or a retry).

Acceptance

• A run of each reusable workflow on the Ubuntu 26 image passes, or the job is pinned with a reason.
• A Lychee run saves its cache (no "Cache save failed"), or the cache steps are gone.
• The next scheduled Lychee run passes, or its remaining errors are real broken links.

Context

Evidence read on 2026-10-02 from run 36933717011 (job annotations and failed-step log) and .github/workflows/lychee.yml on main. The cache warning was first seen on the PR #694 run (36290455364).