Dockerfile builds keep their layer cache

A COPY step used to take the entire build context as its input, so touching any file in your repo — even .git metadata rewritten by every CI checkout — invalidated every RUN layer below it. Copies are now keyed on the content they actually copied, so unrelated changes leave the rest of the build cached. Same for RUN --mount=type=bind.