[lyrixx]

Refs #430, alternative to #449.

The build cache depends on the permissions of the build context files. A checkout made with a 002 umask gets 664 files instead of the 644 ones of the CI, so it never reuses the registry cache pushed by the CI.

The files are now copied from a context stage that normalizes their permissions. The cache key of a COPY --from is computed on the content of this stage, which no longer depends on the umask. COPY --chmod alone doesn't help: its cache key is computed on the source files, before the chmod (docker/buildx#1311, closed as working as designed).

Unlike #449, it works with any build tool and doesn't touch the checkout. The images also get the same permissions whatever the umask. The symbolic --chmod requires Docker 28+ (Dockerfile 1.14).

Fresh builder, cache pushed from a 644 checkout, build from a 664 one:

Dockerfile	frontend	builder
before	12 steps rebuilt	8 steps rebuilt
after	only the context stage (a copy)	nothing

[lyrixx]

closing in favor of #464