Build cryptography without build isolation in the tests session

uv's isolated build environment lives in a temporary directory with a
fresh random name. For non-abi3 builds (the free-threaded jobs)
maturin passes that interpreter to pyo3-build-config as PYO3_PYTHON,
which registers rerun-if-env-changed on it, so every CI run on 3.14t
and 3.15t-dev recompiled pyo3-ffi and pyo3 despite a warm cache, on
all three platforms. Building with the session's own interpreter gives
a stable path. The cache key suffix is bumped so the recorded
fingerprint is refreshed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QZZQDQuPPD8T7jaAsCSHtM

.github/actions/cache/action.yml

diff --git a/.github/actions/cache/action.yml b/.github/actions/cache/action.yml
index b26c830..ed511b8 100644
--- a/.github/actions/cache/action.yml
+++ b/.github/actions/cache/action.yml
@@ -19,7 +19,7 @@
         KEY: "${{ inputs.key }}"
     - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
       with:
-        key: ${{ steps.normalized-key.outputs.key }}-6
+        key: ${{ steps.normalized-key.outputs.key }}-7
     # maturin writes the pyo3 config file to target/maturin/, and pyo3-ffi's
     # build script registers cargo:rerun-if-changed on it. rust-cache's
     # cleanup deletes target/maturin/ before saving, so the file was

noxfile.py

diff --git a/noxfile.py b/noxfile.py
index 9c833a3..9c06ad4 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -82,14 +82,24 @@
 
     install_spec = f".[{','.join(extras)}]"
     install(session, "-e", "./vectors")
+    # Build cryptography with this session's interpreter rather than in an
+    # isolated build environment. The build environment lives in a
+    # temporary directory with a fresh random name, and for non-abi3
+    # builds (free-threaded interpreters) maturin passes that interpreter
+    # to pyo3-build-config as PYO3_PYTHON, which registers
+    # rerun-if-env-changed on it: every CI run recompiled pyo3-ffi and
+    # pyo3 despite a warm cache. The session venv's path is stable.
+    pyproject_data = load_pyproject_toml()
+    install(session, *pyproject_data["build-system"]["requires"])
     if session.name == "tests-rust-debug":
         install(
             session,
+            "--no-build-isolation",
             "--config-settings-package=cryptography:build-args=--profile=dev",
             install_spec,
         )
     else:
-        install(session, install_spec)
+        install(session, "--no-build-isolation", install_spec)
 
     install(
         session,