ci: fix caching

[treyturner]

Summary

• enable BuildKit’s GitHub Actions cache using the gha backend and mode=max
• use the default Buildx container driver, which supports external cache export
• build third-party wheels before copying or applying Beets patches
• cache third-party runtime installation independently from the patched Beets wheel
• build and reinstall the final patched Beets wheel separately
• reject patches that modify packaging or dependency metadata after dependency resolution

Why

GitHub-hosted runners discard their local Docker cache after each job. Additionally, patch changes previously invalidated the combined Beets and third-party wheel build, forcing all dependencies to be rebuilt and reinstalled.

With the new stage ordering, patch-only changes can reuse the dependency wheelhouse and third-party installation layers. Only patch application, the final Beets wheel, and its lightweight reinstall need to run again.

Validation

• completed a full Beets 2.13.1 image build
• verified the installed TIDAL implementation contains the patched source
• verified pip check reports no broken requirements
• passed the Beets version and UMASK checks
• passed Dockerfile static validation with no warnings
• confirmed a patch-only manifest change reuses the dependency-build and third-party-install layers
• confirmed a synthetic pyproject.toml patch is rejected by the safeguard

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T01:39:48.373161Z	a686827	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.