Cache the expensive half of the build so iteration is cheap

The dnf transaction is essentially the whole cost of a build — emulated rpm
scriptlets for 502 packages on minimal, 1929 on workstation. Everything after
it is minutes. Getting this laptop to boot will take several attempts at the
kernel command line and the dracut driver list, and paying for a reinstall each
time is not tenable.

Stage the post-dnf tree under <work>/base, keyed on a hash of the package
lists, release and variant, and copy it per build with --reflink=auto (a CoW
clone on btrfs). Config and overlay edits now reuse it; package list edits
invalidate it on their own, so --fresh is only needed to force the issue.

Keep downloaded rpms in a cachedir outside the install root, so even --fresh
re-runs the scriptlets without re-downloading. keepcache=0 was exactly the
wrong setting for a build meant to be run repeatedly.

Add --work so CI can put both outside the job workspace, which is wiped between
runs, and default the build container to the gongfoo aarch64 build base so the
assembly tooling is not installed under emulation every time. That image is a
speedup, not a dependency: fall back to stock Fedora when it is unreachable.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XWRjNJMistCy6ngXH5aJLS

.gitea/workflows/build-image.yaml

@@ -72,13 +72,34 @@ jobs:
           fi
           cat "$handler"
 
+      # Both of these live outside the job workspace, which is wiped between
+      # runs. On metal runners a host path persists for free and avoids
+      # shuttling multi-gigabyte caches through Gitea's cache store — the
+      # tradeoff being that they are per-runner, so a job landing on a runner
+      # that has not built before starts cold.
+      - name: Prepare persistent build state
+        run: |
+          echo "CACHE_DIR=/var/tmp/c630-build/dnf"   >> "$GITHUB_ENV"
+          echo "WORK_DIR=/var/tmp/c630-build/work"   >> "$GITHUB_ENV"
+          mkdir -p /var/tmp/c630-build/{dnf,work}
+          # Keep it bounded: drop cached rpms nothing has touched in a month.
+          find /var/tmp/c630-build/dnf -type f -atime +30 -delete 2>/dev/null || true
+          du -sh /var/tmp/c630-build/* 2>/dev/null || true
+
       - name: Build
         run: |
           case "${{ matrix.variant }}" in
             workstation) size=16384 ;;
             *)           size=8192  ;;
           esac
-          ./build/build-image.sh --variant "${{ matrix.variant }}" --size "$size"
+          # No --fresh: the stamp in stage2.sh hashes the package lists, so a
+          # change there invalidates the staged base on its own. Checkout is
+          # shallow here anyway, so diffing against HEAD~1 would not be reliable.
+          ./build/build-image.sh \
+            --variant "${{ matrix.variant }}" \
+            --size "$size" \
+            --cache "$CACHE_DIR" \
+            --work "$WORK_DIR"
 
       - name: Checksums
         run: cat output/*.sha256