ci: cache buildkit layers across runs

.github/workflows/docker.yml

@@ -61,6 +61,12 @@ jobs:
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+      # Buildkit cache via the GitHub Actions cache backend (uses the
+      # automatic GITHUB_TOKEN, no extra secrets). mode=max keeps every
+      # stage's layers so the cargo-deps and ffmpeg layers are restored
+      # instead of re-downloaded/recompiled. The scope must be pinned to a
+      # fixed string: the gha backend defaults to the current git ref, which
+      # would give every new tag a cold cache on release builds.
       -
         name: Build and push
         uses: docker/build-push-action@v7
@@ -70,3 +76,5 @@ jobs:
             APP_NAME=${{ env.APP_NAME }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=tgxmb-build
+          cache-to: type=gha,mode=max,scope=tgxmb-build

AGENTS.md

@@ -73,7 +73,7 @@ Docker: `docker build -t tgxmb .` then `docker run --rm -d --name tgxmb --env-fi
 | `Dockerfile` | Multi-stage: cached dep layer via stub sources + `touch *.rs` mtime hack, static ffmpeg from ffmpeg.martin-riedl.de (`FFMPEG_URL` arg, `unzip -t` integrity check), `debian:bookworm-slim` runtime, entrypoint |
 | `docker-entrypoint.sh` | Privilege drop: `useradd` with `LOCAL_USER_ID` (default 9001) + `setpriv` (no gosu on bookworm-slim) |
 | `docker-compose.yml.example` | Deployment env reference (real `docker-compose.yml` is gitignored) |
-| `.github/workflows/docker.yml` | CI: build+push to Docker Hub on tag `v*`/master; **no test step** |
+| `.github/workflows/docker.yml` | CI: build+push to Docker Hub on tag `v*`/master; **no test step**; buildx gha cache (`cache-from`/`cache-to`, scope `tgxmb-build`, `mode=max`) so cargo deps + ffmpeg layers are restored across runs |
 | `README.md` | Feature docs + command table (Chinese) |
 
 ## Runtime/Tooling Preferences