perf(ci): scope the Docker layer cache per image and platform

setup-docker-builder@v1 keys the sticky disk on the repository name alone,
so all five images across amd64 and arm64 shared one disk. Parallel matrix
jobs clone the same parent snapshot and only one commit per wave survives,
which is why app.Dockerfile's deps stage rebuilt every run.

Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

Author: waleedlatif1

.github/actions/docker-build/action.yml

@@ -25,9 +25,31 @@ inputs:
 runs:
   using: composite
   steps:
+    # One sticky disk per Dockerfile per platform. setup-docker-builder@v1 keyed
+    # the disk on the repository name alone, so all five images (x amd64/arm64)
+    # shared a single disk. Every job in a matrix clones the same parent
+    # snapshot and only one commit per wave becomes the next parent (in
+    # practice the first job to finish, never the app build). Its `deps`
+    # layer was written to the disk every run and discarded every run, so the
+    # stage rebuilt from scratch (~300-465s) despite being provably cacheable.
+    #
+    # Platform is part of the key because build-amd64 and build-ghcr-arm64 build
+    # the same Dockerfiles concurrently on main; a shared key would reproduce the
+    # same clobbering between them, and the two share no layers anyway.
+    - name: Resolve Docker layer cache key
+      id: cache-key
+      if: inputs.provider == '' || inputs.provider == 'blacksmith'
+      shell: bash
+      env:
+        FILE: ${{ inputs.file }}
+        PLATFORMS: ${{ inputs.platforms }}
+      run: echo "value=${GITHUB_REPOSITORY##*/}/${FILE#./}/${PLATFORMS//\//-}" >> "$GITHUB_OUTPUT"
+
     - name: Set up Blacksmith builder
       if: inputs.provider == '' || inputs.provider == 'blacksmith'
-      uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1
+      uses: useblacksmith/setup-docker-builder@a5256a73e30f09e37e3eceb8ca36043d17621d24 # v2
+      with:
+        cache-key: ${{ steps.cache-key.outputs.value }}
 
     - name: Build and push (Blacksmith)
       if: inputs.provider == '' || inputs.provider == 'blacksmith'