fix(ci): hoist ARG VERSION to final stage to stop cache busting

Root cause of remaining cache misses: the base stage declared
ARG VERSION, and the build job passed VERSION=${{ github.sha }}.
Since VERSION changes every commit, every base/app layer cache key
changed with it — so layers rebuilt every run regardless of scope.

Additionally the test job passed no build-args while the build job
passed GITHUB_BUILD=true + VERSION, so test's cached base/app layers
had different keys from build's — cross-job reuse never hit either.

Fix:
- Dockerfile: move ARG VERSION / ENV VERSION from base to the final
  runtime stage (FROM app). VERSION is only read at runtime by
  src.consts via Pydantic settings; base/app layers don't use it.
  base/app now cache without per-commit VERSION variation.
- workflow: pass --build-arg GITHUB_BUILD=true in the test step so
  test and build share identical base/app cache keys (cross-job reuse).

VERSION is intentionally NOT passed to the test job: the test stage
(FROM app AS test) doesn't read VERSION, and omitting it keeps the
base/app cache keys identical between test and build.

.github/workflows/docker-publish.yml

@@ -69,6 +69,8 @@ jobs:
           pull: true
           cache-to: type=gha,mode=max,scope=amd64
           target: test
+          build-args: |
+            GITHUB_BUILD=true
 
   build:
     needs: test

Dockerfile

@@ -3,12 +3,9 @@
 # cannot install firefox deps for (no libgtk-3 -> camoufox fails to launch).
 FROM ubuntu:24.04 AS base
 
-ARG GITHUB_BUILD=false \
-    VERSION
+ARG GITHUB_BUILD=false
 
 ENV GITHUB_BUILD=${GITHUB_BUILD}\
-    VERSION=${VERSION}\
-    DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1 \
     # prevents python creating .pyc files
     PYTHONDONTWRITEBYTECODE=1 \
@@ -57,6 +54,11 @@ RUN \
     uv run pytest --retries 3
 
 FROM app
+# VERSION is a runtime-only env var (read by src.consts via Pydantic settings).
+# Declared here, not in base, so base/app layer cache keys don't depend on the
+# per-commit SHA — that would bust the cache every run.
+ARG VERSION
+ENV VERSION=${VERSION}
 USER 1000
 EXPOSE $PORT
 HEALTHCHECK --interval=15m --timeout=30s --start-period=5s --retries=3 CMD curl "http://127.0.0.1:${PORT}/health"