perf(image): build the collections into a layer the source cannot invalidate

COPY . preceded every expensive RUN, so each commit rebuilt the whole
chain and ansible-galaxy ran on every build of every distro. The
collection install now sits in its own layer fed only by default.env,
scripts/install, the dev-python shell scripts, requirements/ and the
three files the version check imports. Everything that needs the full
tree, the project's own distro package included, stays behind COPY ..

Measured on a role-only change: the collection layer stays CACHED and
the build drops to 3m10s against a CI baseline of 855-899s. An
unchanged rebuild is 15 cached layers in 1.5s.

The gha cache imported and exported nothing in a plain run step, so the
export moves to the registry the job already authenticates against.
ignore-error keeps a cache write failure from taking the build with it,
which it otherwise does: proven against an unreachable registry, where
the build fails hard without it and exits 0 with it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -26,6 +26,24 @@ RUN set -euo pipefail; \
     echo 'accept-flake-config = true' >> /etc/nix/nix.conf; \
   fi
 
+COPY default.env ${INFINITO_SRC_DIR}/default.env
+COPY scripts/install ${INFINITO_SRC_DIR}/scripts/install
+COPY roles/dev-python/files/shell ${INFINITO_SRC_DIR}/roles/dev-python/files/shell
+COPY requirements ${INFINITO_SRC_DIR}/requirements
+COPY utils/__init__.py ${INFINITO_SRC_DIR}/utils/__init__.py
+COPY utils/install/__init__.py ${INFINITO_SRC_DIR}/utils/install/__init__.py
+COPY utils/install/collections.py ${INFINITO_SRC_DIR}/utils/install/collections.py
+
+# hadolint ignore=DL3008,DL3033,DL3041,SC1090,SC3040
+RUN set -euo pipefail; \
+  source <(grep -hE '^INFINITO_PYTHON_INSTALL_SCRIPT=' "${INFINITO_SRC_DIR}/default.env"); \
+  /bin/bash "${INFINITO_SRC_DIR}/${INFINITO_PYTHON_INSTALL_SCRIPT:?}" ensure; \
+  VENV="${INFINITO_VENV_DIR}" bash "${INFINITO_SRC_DIR}/scripts/install/venv.sh"; \
+  ${PIP} install --upgrade pip setuptools wheel; \
+  ${PIP} install ansible PyYAML; \
+  ANSIBLE_COLLECTIONS_DIR="${HOME}/.ansible/collections" \
+    bash "${INFINITO_SRC_DIR}/scripts/install/ansible.sh"
+
 COPY . ${INFINITO_SRC_DIR}
 
 # hadolint ignore=DL3008,DL3033,DL3041,SC1090

scripts/image/push.sh

@@ -19,6 +19,8 @@ source "${script_dir}/../meta/env/load.sh"
 ghcr_owner="$(scripts/meta/resolve/repository/owner.sh)"
 repo_name="$("${script_dir}/../meta/resolve/repository/name.sh")"
 
+cache_ref="ghcr.io/${ghcr_owner}/${repo_name}/${MATRIX_DISTRO}:buildcache"
+
 max_attempts="${MAX_ATTEMPTS:-7}"
 retry_delay_seconds="${RETRY_DELAY_SECONDS:-20}"
 attempt=1
@@ -46,8 +48,8 @@ while true; do
 		--build-arg "INFINITO_PYTHON_INSTALL_SCRIPT=${INFINITO_PYTHON_INSTALL_SCRIPT:?source scripts/meta/env/load.sh}" \
 		--build-arg "INFINITO_DOCKER_CLI_INSTALL_SCRIPT=${INFINITO_DOCKER_CLI_INSTALL_SCRIPT:?source scripts/meta/env/load.sh}" \
 		"${nix_arg[@]}" \
-		--cache-from "type=gha,scope=${repo_name}-${MATRIX_DISTRO}" \
-		--cache-to "type=gha,mode=max,scope=${repo_name}-${MATRIX_DISTRO}" \
+		--cache-from "type=registry,ref=${cache_ref}" \
+		--cache-to "type=registry,mode=max,ignore-error=true,ref=${cache_ref}" \
 		"${BUILD_CONTEXT_DIR}"; then
 		echo "Build & push succeeded on attempt ${attempt}/${max_attempts}."
 		break