ci: Include root pubspec.yaml in pub cache key

[cbracken]

The pub package cache step in composite-flutter-setup keys its cache on a hash of the pubspec.yaml files found under dev/, examples/, and packages/, but omits the root workspace pubspec.yaml. The root pubspec pins the versions of all transitive dependencies, so a pub roll that only touches the root, leaves the hash, and therefore the hash key, unchanged. This is exactly what happens on pub package rolls like #189760.

When that happens the cache still hits and restores a stale pubspec.lock over the freshly checked-out one. At that point, the following flutter update-packages then fails when run with --enforce-lockfile, since the lock file we just restored from cache no longer matches the pinned versions in the checked-out root pubspec.yaml, which breaks the Tree Analyze step tree-wide until the cache is manually invalidated.

We now include the root pubspec.yaml in the hash so that a packages only roll changes the cache key, forcing a fresh package resolve rather than restoring a stale lock.

Fixes: #189825

Pre-launch Checklist

• I read the Contributor Guide and followed the process outlined there for submitting PRs.
• I read the AI contribution guidelines and understand my responsibilities, or I am not using AI tools.
• I read the Tree Hygiene wiki page, which explains my responsibilities.
• I read and followed the Flutter Style Guide, including Features we expect every widget to implement.
• I signed the CLA.
• I listed at least one issue that this PR fixes in the description above.
• I updated/added relevant documentation (doc comments with ///).
• I added new tests to check the change I am making, or this PR is test-exempt.
• I followed the breaking change policy and added Data Driven Fixes where supported.
• All existing and new tests are passing.

If you need help, consider asking for advice on the #hackers-new channel on Discord.

If this change needs to override an active code freeze, provide a comment explaining why. The code freeze workflow can be overridden by code reviewers. See pinned issues for any active code freezes with guidance.

Note: The Flutter team is currently trialing the use of Gemini Code Assist for GitHub. Comments from the gemini-code-assist bot should not be taken as authoritative feedback from the Flutter team. If you find its comments useful you can update your code accordingly, but if you are unsure or disagree with the feedback, please feel free to wait for a Flutter team member's review for guidance on which automated comments should be addressed.

[gemini-code-assist]

Code Review

This pull request updates the GitHub Action composite-flutter-setup to include the root pubspec.yaml file when generating the stable hash for dependency caching. Feedback was provided to correct a typo in the updated comment, which incorrectly refers to pubspec.yaml as package.yaml.

[jtmcdole]

Hash only tracked pubspec.yaml files in the tree and their contents... its faster because the objects are already in the git db:

git ls-tree HEAD -- $(git ls-files '*/pubspec.yaml') | git hash-object --stdin

[jtmcdole]

my approval isn't enough since I made the last commit.

[ievdokdm]

LGTM