POC: Deduplicate the GMT cache download step into a composite action

[seisman]

Note

Proof of concept, opened as a draft for discussion. It works and CI should pass,
but the point is to decide whether we want local composite actions in this repo at all
before going further.

What this does

Six workflows each carried their own copy of the step that downloads the gmt-cache
artifact into ~/.gmt: benchmarks, ci_docs, ci_doctests, ci_tests,
ci_tests_dev and ci_tests_legacy.

All six were functionally identical — the only differences were comment drift
("Download files" vs "Download cached files" in ci_tests, and a stray trailing period
in ci_tests_legacy), which is the usual symptom of copy-paste.

They now share .github/actions/download-gmt-cache:

      - name: Download remote data from GitHub
        uses: ./.github/actions/download-gmt-cache

Net -48/+6 lines in the workflows.

Things worth knowing before deciding

• This would be the first composite action in the repo, so it sets a precedent for
  how CI logs read: the inner step is nested under the outer step name rather than
  appearing flat in the step list.
• Composite actions do not inherit defaults.run.shell. All six jobs use
  shell: bash -l {0}, so the action sets that explicitly. Without it the step would
  silently fall back to plain bash, which behaves differently on the Windows runners
  in ci_docs.
• No runtime cost worth caring about. A local composite action runs in the same job
  on the same runner and needs no download (it comes from the checkout), unlike a
  reusable workflow, which would add a separate job. The step it replaces takes ~33 s in
  a recent ci_tests run, so the wrapper overhead is noise.
• uses: ./ reads the action from the checked-out tree, so on pull_request a fork
  could alter its contents. Not a new exposure for these particular workflows — they
  already execute PR code via make install/make test, with permissions: {} and no
  secrets — but it is a difference from an inline step, which always comes from the base
  branch.
• zizmor reports no new findings.

Possible follow-ups, deliberately not done here

• Get current week number of year (4 workflows) and make install (5 workflows) are
  also duplicated, but they are 1-2 lines each, so wrapping them likely costs more in
  indirection than it saves.

Idea by @seisman, and implemented by Claude Code