feat(ci): cache the docs image build through ghcr.io

[Minipada]

Summary

• tools/ci/pre-commit/build_doc.sh never wired up a registry build cache — unlike tools/e2e/scripts/build.sh, which already accepts CACHE_REF and passes --cache-from/--cache-to to podman build. Every GitHub Actions run is a fresh VM, so podman's local build cache never survives between runs; doc.yaml's image (a Rust toolchain + five cargo installs) was rebuilding from scratch on every single run.
• Added the same CACHE_REF mechanism to build_doc.sh, mirroring build.sh's pattern.
• Wired doc.yaml to log into ghcr.io, compute a stable dc-doc-cache ref, and pass it through — mirroring ci.yaml's build-workspace job (including the lowercasing dance, since ghcr image names must be lowercase).
• packages: write was added to doc.yaml's permissions, but note: GitHub forces GITHUB_TOKEN to read-only on pull_request from a fork regardless of what's requested — documented inline. A fork PR just builds cold, same as before this change; the build does not fail.

Deliberately out of scope

ci.yaml's build-e2e-image job also runs a bare podman build (tools/e2e/Containerfile.e2e) with no cache flags. Its FROM is the just-built, SHA-tagged workspace image — a different ref every run — so a cache keyed on the prior layer's digest can never hit there. The layer itself is also just 3 COPYs + a chmod (sub-second). Wiring the same mechanism onto it would be cargo-culting with no effect, so it's left as-is.

Test plan

• IMAGE_TAG=dc-doc:cachetest ./tools/ci/pre-commit/build_doc.sh run twice back-to-back locally (no CACHE_REF) — clean build both times, second run shows Using cache <digest> on all 12 STEPs, confirming --layers doesn't regress local caching
• pre-commit run --files .github/workflows/doc.yaml tools/ci/pre-commit/build_doc.sh — check-yaml, shellcheck, and the build-doc hook (real strictdoc export + mdbook build) pass
• Not verified: the actual ghcr.io cache round-trip on a live Actions run (needs this PR's own CI to exercise the new steps)

Closes #315

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

https://claude.ai/code/session_01BxvjR5XyyaEPBBpwGfUK9W

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 40.48%. Comparing base (6b14911) to head (aea023b).
⚠️ Report is 2 commits behind head on jazzy.

Additional details and impacted files

@@           Coverage Diff           @@
##            jazzy     #316   +/-   ##
=======================================
  Coverage   40.48%   40.48%           
=======================================
  Files          82       82           
  Lines        5094     5094           
=======================================
  Hits         2062     2062           
  Misses       3032     3032           

Flag	Coverage Δ
cpp-jazzy	40.48% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.