perf(ci): scope the Docker layer cache per image and platform (#6501)

setup-docker-builder@v1 keys the sticky disk on the repository name alone,
so all five images across amd64 and arm64 shared one disk. Parallel matrix
jobs clone the same parent snapshot and only one commit per wave survives,
which is why app.Dockerfile's deps stage rebuilt every run.

Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

.github/actions/docker-build/action.yml

@@ -25,9 +25,28 @@ inputs:
 runs:
   using: composite
   steps:
+    # One sticky disk per Dockerfile per platform. v1 keyed it on the repo name
+    # alone, so every image shared one disk: matrix jobs all clone the same
+    # parent snapshot and only the first to finish becomes the next parent, so
+    # the app image's `deps` layer was written and discarded every run (~300-465s
+    # rebuilt each time). Platform is in the key because amd64 and arm64 build
+    # the same Dockerfiles concurrently on main and share no layers. Ref is
+    # deliberately not: cross-ref reuse is the point, and an occasional overlap
+    # costs one rebuild.
+    - name: Resolve Docker layer cache key
+      id: cache-key
+      if: inputs.provider == '' || inputs.provider == 'blacksmith'
+      shell: bash
+      env:
+        FILE: ${{ inputs.file }}
+        PLATFORMS: ${{ inputs.platforms }}
+      run: echo "value=${GITHUB_REPOSITORY##*/}/${FILE#./}/${PLATFORMS//\//-}" >> "$GITHUB_OUTPUT"
+
     - name: Set up Blacksmith builder
       if: inputs.provider == '' || inputs.provider == 'blacksmith'
-      uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1
+      uses: useblacksmith/setup-docker-builder@a5256a73e30f09e37e3eceb8ca36043d17621d24 # v2
+      with:
+        cache-key: ${{ steps.cache-key.outputs.value }}
 
     - name: Build and push (Blacksmith)
       if: inputs.provider == '' || inputs.provider == 'blacksmith'