ci: stop version bumps rebuilding the eval Docker image (cache key trio)

Three coupled fixes, atomic because any subset is worse than none:

1. Image tag keys on hashFiles(Dockerfile.ci, bun.lock) — package.json is
   out: its version field changed on 60/60 recent commits, forcing a ~2min
   image rebuild per PR for a dependency set only bun.lock determines.
2. ci-image.yml now pushes that same content-hash tag (previously only
   :latest/:sha, so the weekly prebuild never warmed the tag the eval
   matrix actually looks up) and both eval workflows get registry layer
   cache (cache-to export gated to same-repo runs; fork tokens cannot
   write GHCR).
3. Dockerfile bakes /opt/node_modules_cache/.bun.lock and the runtime
   Restore-deps guard diffs bun.lock instead of package.json — otherwise
   every version-only bump made all 14 matrix jobs fall back to a live
   bun install, which is slower than today's behavior.

Worst-case failure mode is self-healing: a missing tag or cache falls
back to exactly the previous rebuild-and-install path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/evals.yml

@@ -25,7 +25,12 @@ jobs:
       - uses: actions/checkout@v4
 
       - id: meta
-        run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'package.json', 'bun.lock') }}" >> "$GITHUB_OUTPUT"
+        # Key on Dockerfile + lockfile only. package.json is deliberately NOT
+        # hashed: its version field changes on every ship (60/60 recent commits),
+        # which rebuilt the image each time for a dependency set that only
+        # bun.lock determines. A stale baked package.json is harmless — checkout
+        # overwrites /workspace and node_modules comes from the lockfile.
+        run: echo "tag=${{ env.IMAGE }}:${{ hashFiles('.github/docker/Dockerfile.ci', 'bun.lock') }}" >> "$GITHUB_OUTPUT"
 
       - uses: docker/login-action@v3
         with:
@@ -55,6 +60,10 @@ jobs:
           context: .github/docker
           file: .github/docker/Dockerfile.ci
           push: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+          # Registry layer cache: reads are safe everywhere; the export is gated
+          # to same-repo runs because a fork PR's token can't write GHCR.
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache
+          cache-to: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref={0}:buildcache,mode=max', env.IMAGE) || '' }}
           tags: |
             ${{ steps.meta.outputs.tag }}
             ${{ env.IMAGE }}:latest
@@ -142,7 +151,7 @@ jobs:
       # vastly cheaper than rerunning `bun install` (network + resolution).
       - name: Restore deps
         run: |
-          if [ -d /opt/node_modules_cache ] && diff -q /opt/node_modules_cache/.package.json package.json >/dev/null 2>&1; then
+          if [ -d /opt/node_modules_cache ] && diff -q /opt/node_modules_cache/.bun.lock bun.lock >/dev/null 2>&1; then
             cp -r /opt/node_modules_cache node_modules
           else
             bun install