ci: isolate Docker image builders

[staging-devin-ai-integration]

Summary

• Bind each CPU, GPU, and demo image build to the exact buildx builder created by its job, preventing same-host runners from sharing the implicit current builder or removing one another's builder mid-build.
• Split the persistent local layer cache by image and create each directory before import, avoiding concurrent writers while retaining warm caches.
• Add a lightweight workflow invariant check to the normal lint path so builder/cache isolation cannot be removed unnoticed.

Review & Validation

• Run the Docker workflow with push=false and confirm each concurrent job reports the same builder name created by its own setup-buildx step.

Notes

Focused workflow validation and git diff --check pass. Full local just lint reached cargo deny but the installed CLI rejected the existing --metadata-path argument; this PR does not alter that unrelated tool mismatch.

Link to Devin session: https://staging.itsdev.in/sessions/738c0703efe441cb80769d070c318be6
Open in Devin Desktop: https://staging.itsdev.in/desktop/session/738c0703efe441cb80769d070c318be6?variant=devin-insiders
Requested by: @streamer45

---

Devin Review

Status	Commit
🟢 Reviewed	7504c9f

[staging-devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[staging-devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Debug

Playground