perf: cache pip downloads and Docker layers in CI build

- Add BuildKit pip cache mount to Dockerfile (persists torch/transformers
  downloads across builds on the runner host)
- Enable DOCKER_BUILDKIT=1 in workflow env
- Pull previous image before build for layer cache reuse
- Add --cache-from latest + BUILDKIT_INLINE_CACHE=1 to docker build

BUILDKIT_INLINE_CACHE embeds cache metadata in the pushed image so
--cache-from works from the registry (cold runner or new runner).
SHA tag push reuses already-pushed layers - only metadata transferred.

Expected improvement:
- Unchanged code:       ~5 min -> ~30 sec (layer cache hit)
- requirements changed: ~5 min -> ~1 min (pip disk cache)
- Push:                 only changed layers uploaded; SHA tag is free

Dockerfile

@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile:1
 FROM python:3.12-slim
 
 ARG BUILD_VERSION=unknown
@@ -15,10 +16,12 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 
 WORKDIR /app
 
-RUN pip install --upgrade --no-cache-dir pip
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install --upgrade pip
 
 COPY requirements.txt ./
-RUN pip install --no-cache-dir -r requirements.txt
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install -r requirements.txt
 
 COPY . .