ci: isolate Docker build caches

[djwhitt]

Summary

• isolate GitHub Actions cache objects by image role and CPU architecture
• cancel superseded Docker image builds for the same pushed ref
• skip production image builds for test-only, benchmark-only, and root-Markdown-only changes
• exclude non-production and local build artifacts from the Docker context
• run the Docker build check when .dockerignore or Cargo workspace manifests change

Motivation

Docker's GHA cache backend defaults every build to the buildkit scope, where each exporter overwrites the previous cache. The application, base, runner, PR-check, amd64, and arm64 builds currently share that default scope.

In main run 31831544506, the arm64 Buildx step took 13m47s, including 5m30s recompiling Mix dependencies and 2m57s exporting the cache. That run followed a test-only PR, but tests were still included in the Docker context and invalidated COPY . ./.

Validation

• actionlint passes for the three changed workflows after excluding pre-existing diagnostics for legacy action versions and custom Blacksmith runner labels
• Docker Build Check passed (run 31839879777)
• independent review found no remaining actionable workflow or context-exclusion issues

Stack

1. This PR: cache isolation, build cancellation, and context filtering
2. build: cache native release compilation #3832: cache native Rust release compilation in a dedicated Docker layer