ci: stop version bumps rebuilding the eval Docker image (cache key trio)

Three coupled fixes, atomic because any subset is worse than none:

1. Image tag keys on hashFiles(Dockerfile.ci, bun.lock) — package.json is
   out: its version field changed on 60/60 recent commits, forcing a ~2min
   image rebuild per PR for a dependency set only bun.lock determines.
2. ci-image.yml now pushes that same content-hash tag (previously only
   :latest/:sha, so the weekly prebuild never warmed the tag the eval
   matrix actually looks up) and both eval workflows get registry layer
   cache (cache-to export gated to same-repo runs; fork tokens cannot
   write GHCR).
3. Dockerfile bakes /opt/node_modules_cache/.bun.lock and the runtime
   Restore-deps guard diffs bun.lock instead of package.json — otherwise
   every version-only bump made all 14 matrix jobs fall back to a live
   bun install, which is slower than today's behavior.

Worst-case failure mode is self-healing: a missing tag or cache falls
back to exactly the previous rebuild-and-install path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci-image.yml

@@ -25,6 +25,12 @@ jobs:
       # Copy lockfile + package.json into Docker build context
       - run: cp package.json bun.lock .github/docker/
 
+      # Same content-hash tag expression as evals.yml / evals-periodic.yml.
+      # This is the tag the eval matrix looks up first — without pushing it
+      # here, the weekly/main prebuild never warms the cache that matters.
+      - id: meta
+        run: echo "tag=ghcr.io/${{ github.repository }}/ci:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT"
+
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -36,6 +42,9 @@ jobs:
           context: .github/docker
           file: .github/docker/Dockerfile.ci
           push: true
+          cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/ci:buildcache
+          cache-to: type=registry,ref=ghcr.io/${{ github.repository }}/ci:buildcache,mode=max
           tags: |
+            ${{ steps.meta.outputs.tag }}
             ghcr.io/${{ github.repository }}/ci:latest
             ghcr.io/${{ github.repository }}/ci:${{ github.sha }}