ci(docker): cache smoke-test image layers via GHA cache (#3197 docker half)

Build the Docker image once in a build-image job, cache layers via type=gha,
restore from cache in each smoke variant instead of rebuilding. Variant restore
uses cache-from only (build-image is the sole cache writer).

Co-authored-by: hayriodabas <hayriodabas@users.noreply.github.com>

.github/workflows/docker-smoke.yml

@@ -66,10 +66,31 @@ jobs:
             echo "::endgroup::"
           done
 
+  # Build the Docker image once and cache layers via GHA cache.
+  # The smoke matrix jobs then pull from this cache instead of rebuilding
+  # from scratch, saving ~1-3 minutes per variant.
+  build-image:
+    name: Build Docker image (cache layers)
+    runs-on: ubuntu-latest
+    needs: compose-config
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Build and cache Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          load: true
+          tags: ghcr.io/nesquena/hermes-webui:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
   smoke:
     name: Smoke ${{ matrix.variant }}
     runs-on: ubuntu-latest
-    needs: compose-config
+    needs: [compose-config, build-image]
     timeout-minutes: 15
     strategy:
       fail-fast: false
@@ -81,6 +102,19 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - uses: docker/setup-buildx-action@v3
+
+      # Restore the cached Docker image from the build-image job.
+      # Read-only: the build-image job already populated the GHA cache, so the
+      # smoke variants only need cache-from (no redundant cache-to re-export).
+      - name: Restore Docker image from cache
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          load: true
+          tags: ghcr.io/nesquena/hermes-webui:latest
+          cache-from: type=gha
+
       - name: Resolve compose file + project name
         id: vars
         run: |
@@ -119,15 +153,6 @@ jobs:
             docker network rm "$n" || true
           done
 
-      - name: Build local Dockerfile
-        # We always build the local Dockerfile so the PR's changes are tested,
-        # even on the multi-container variants whose compose files reference
-        # ghcr.io/nesquena/hermes-webui:latest. Without this retag, multi-container
-        # smoke runs would test the previous release, not the PR.
-        run: |
-          set -euo pipefail
-          docker build -t ghcr.io/nesquena/hermes-webui:latest .
-
       - name: Prepare ephemeral host paths
         id: paths
         run: |