Problem

A report of the arm64 Docker build "regularly failing" turned out to be cancellation noise, not real failures. Across the last 110 completed `docker-publish` runs:

The single `failure` was a PR-code esbuild error that failed on both arches identically — not arm64-specific. The real signal is that arm64 is cancelled 2.6× more than amd64. In 8 recent runs amd64 succeeded while arm64 was cancelled in the same superseded run. A cancelled job renders as a red ✗ in PR checks → reads as "the arm64 build keeps failing."

Why arm64 is the cancellation casualty

arm64 PR builds run fully uncached. The previous `type=gha` cache was removed from arm64 PRs because cold-cache arm64 builds outlived GitHub's short-lived Azure cache SAS token and crashed on a cache blob op before the smoke test. Uncached → arm64 PR builds are ~45% slower than amd64 (median 553s vs 382s, max 819s), so on fast-iterated branches `cancel-in-progress` kills the still-running arm64 job while amd64 has already finished.

Fix

Switch arm64 to a registry-backed cache on ghcr.io (`type=registry`, ref `ghcr.io/nousresearch/hermes-agent:buildcache-arm64`).

Why this won't repeat the gha failure: the registry cache authenticates with the job-lifetime `GITHUB_TOKEN`, not a time-boxed SAS token minted at job start that expires mid-build. The exact cold-build-outlives-token failure mode that killed `type=gha` on slow arm64 builds cannot recur.

• PR builds: `cache-from` only (read-only) — pull warm layers from the last main build, never write, so rapid PR pushes don't race on cache writes or pollute the cache ref.
• main/release builds: `cache-from` + `cache-to` (`mode=max`) to populate the cache and let the digest push reuse the smoke-test build's layers.
• Adds `packages: write` permission + a ghcr.io login for the cache.

amd64 keeps its gha cache unchanged — it builds fast enough to stay inside the SAS token's lifetime and never hit this failure mode.

Impact case

This is the default path for every arm64 PR build, not a narrow edge case: every contributor iterating on a Docker-touching PR currently sees arm64 finish last and get cancelled on their next push. The fix restores warm-cache speed to that path, which should bring arm64 build time toward amd64's and largely end the spurious red ✗.

Bootstrap note

`buildcache-arm64` doesn't exist until the first main/release build runs `cache-to`. Until then, PR builds hit a missing ref → buildx treats it as a cache miss (warning, not error) and builds cold — i.e. identical to today, no regression before the first main build populates it.

Verification

• `actionlint` clean on the workflow.
• YAML parses.
• Behavior verification (real cache hit rate + cancellation-rate drop) requires this to land on `main` so the first `cache-to` populates the ref — flagging that it's a post-merge observation, not something the PR's own CI can prove (PR builds are read-only and the ref is empty until main writes it).